@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/src/modules/attachments/api/route.ts

@@ -37,12 +37,15 @@ import {
   sanitizeUploadedFileName,
 } from '../lib/security'
 import {
+  isMultipartUploadLimitError,
   isMultipartRequestWithinUploadLimit,
+  parseMultipartFormDataWithinUploadLimit,
   resolveAttachmentMaxBytes,
   willExceedAttachmentTenantQuota,
 } from '../lib/upload-limits'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { AttachmentQuotaService } from '../lib/quota-service'
 
 const logger = createLogger('attachments')
 
@@ -283,10 +286,22 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: 'Expected multipart/form-data' }, { status: 400 })
   }
   if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {
-    return NextResponse.json({ error: 'Attachment exceeds the maximum upload size.' }, { status: 413 })
+    return NextResponse.json({
+      error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),
+    }, { status: 413 })
   }
 
-  const form = await req.formData()
+  let form: FormData
+  try {
+    form = await parseMultipartFormDataWithinUploadLimit(req)
+  } catch (error) {
+    if (isMultipartUploadLimitError(error)) {
+      return NextResponse.json({
+        error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),
+      }, { status: 413 })
+    }
+    throw error
+  }
   const formPayload = buildFormPayload(form)
   const customFieldValues = splitCustomFieldPayload(formPayload).custom
   const entityId = String(form.get('entityId') || '')
@@ -305,6 +320,20 @@ export async function POST(req: Request) {
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
   const dataEngine = container.resolve('dataEngine')
+  let attachmentQuotaService: AttachmentQuotaService | null = null
+  let attachmentQuotaRecoveryScheduler: ((
+    payload: { reservationId: string; tenantId: string; organizationId: string },
+    delayMs: number,
+  ) => Promise<void>) | null = null
+  try {
+    attachmentQuotaService = container.resolve('attachmentQuotaService') as AttachmentQuotaService
+    attachmentQuotaRecoveryScheduler = container.resolve('attachmentQuotaRecoveryScheduler') as (
+      payload: { reservationId: string; tenantId: string; organizationId: string },
+      delayMs: number,
+    ) => Promise<void>
+  } catch {
+    // Legacy fallback below when the quota service is not registered in this container.
+  }
   const storageDriverFactory =
     (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
   const orgId = await resolveAttachmentOrganizationId(container, auth, req)
@@ -349,11 +378,20 @@ export async function POST(req: Request) {
       error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),
     }, { status: 413 })
   }
-  const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)
-  if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {
-    return NextResponse.json({
-      error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),
-    }, { status: 413 })
+  if (!attachmentQuotaService) {
+    try {
+      const tenantUsageBytes = await readTenantAttachmentUsageBytes(em, tenantId)
+      if (willExceedAttachmentTenantQuota(tenantUsageBytes, file.size)) {
+        return NextResponse.json({
+          error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),
+        }, { status: 413 })
+      }
+    } catch (error) {
+      logger.error('Attachment quota accounting failed', { err: error })
+      return NextResponse.json({
+        error: t('attachments.errors.quotaUnavailable', 'Storage quota accounting is unavailable.'),
+      }, { status: 500 })
+    }
   }
   const buf = Buffer.from(await file.arrayBuffer())
   const safeName = sanitizeUploadedFileName(file.name)
@@ -395,6 +433,62 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: t('attachments.errors.publicPartitionBlocked', 'Public storage partitions cannot be selected explicitly for this upload.') }, { status: 403 })
   }
   const uploadDriver = await storageDriverFactory.resolveForPartition(partition.code, { tenantId, organizationId: orgId })
+  const preparedStoragePath = attachmentQuotaService
+    ? uploadDriver.prepareStoragePath?.({
+        partitionCode: partition.code,
+        orgId,
+        tenantId,
+        fileName: safeName,
+      })
+    : undefined
+  if (attachmentQuotaService && !preparedStoragePath) {
+    return NextResponse.json({
+      error: t('attachments.errors.quotaRecoveryUnsupported', 'Storage driver cannot participate in quota recovery.'),
+    }, { status: 500 })
+  }
+  let quotaReservation: { id: string; leaseToken: string; expiresAt: Date } | null = null
+  if (attachmentQuotaService) {
+    try {
+      quotaReservation = await attachmentQuotaService.reserve({
+        tenantId,
+        organizationId: orgId,
+        bytes: buf.length,
+        source: 'attachment',
+        storageDriver: uploadDriver.key,
+        storagePath: preparedStoragePath!,
+        partitionCode: partition.code,
+      })
+      if (!attachmentQuotaRecoveryScheduler) throw new Error('Attachment quota recovery is unavailable.')
+      await attachmentQuotaRecoveryScheduler({
+        reservationId: quotaReservation.id,
+        tenantId,
+        organizationId: orgId,
+      }, Math.max(1_000, quotaReservation.expiresAt.getTime() - Date.now()))
+      if (typeof attachmentQuotaService.beginStorage === 'function') {
+        await attachmentQuotaService.beginStorage(quotaReservation.id, quotaReservation.leaseToken)
+      }
+    } catch (error) {
+      if (quotaReservation) {
+        await attachmentQuotaService.release(quotaReservation.id, quotaReservation.leaseToken).catch(() => {})
+        quotaReservation = null
+      }
+      const code = (error as { code?: unknown })?.code
+      if (code === 'quota_exceeded') {
+        return NextResponse.json({
+          error: t('attachments.errors.quotaExceeded', 'Attachment storage quota exceeded for this tenant.'),
+        }, { status: 413 })
+      }
+      if (code === 'quota_target_exists') {
+        return NextResponse.json({
+          error: t('attachments.errors.storagePathExists', 'The target storage path already exists.'),
+        }, { status: 409 })
+      }
+      logger.error('Attachment quota reservation failed', { err: error })
+      return NextResponse.json({
+        error: t('attachments.errors.quotaUnavailable', 'Storage quota accounting is unavailable.'),
+      }, { status: 500 })
+    }
+  }
   let storedPath: string
   try {
     const stored = await uploadDriver.store({
@@ -403,10 +497,25 @@ export async function POST(req: Request) {
       tenantId,
       fileName: safeName,
       buffer: buf,
+      storagePath: preparedStoragePath,
     })
     storedPath = stored.storagePath
+    if (quotaReservation) {
+      await attachmentQuotaService!.markStored(quotaReservation.id, quotaReservation.leaseToken)
+    }
   } catch (error) {
     logger.error('Failed to persist file', { err: error })
+    if (preparedStoragePath) {
+      try {
+        await (uploadDriver.deleteStrict?.(partition.code, preparedStoragePath)
+          ?? uploadDriver.delete(partition.code, preparedStoragePath))
+        if (quotaReservation) {
+          await attachmentQuotaService!.release(quotaReservation.id, quotaReservation.leaseToken)
+        }
+      } catch (cleanupError) {
+        logger.error('Failed to compensate attachment storage', { err: cleanupError })
+      }
+    }
     return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })
   }
 
@@ -471,9 +580,21 @@ export async function POST(req: Request) {
           values: customFieldValues,
         })
       }
+      if (quotaReservation) {
+        await attachmentQuotaService!.completeAttachment(quotaReservation.id, quotaReservation.leaseToken, tx)
+      }
     })
   } catch (error) {
     logger.error('Failed to persist attachment with custom attributes', { err: error })
+    try {
+      await (uploadDriver.deleteStrict?.(partition.code, storedPath)
+        ?? uploadDriver.delete(partition.code, storedPath))
+      if (quotaReservation) {
+        await attachmentQuotaService!.release(quotaReservation.id, quotaReservation.leaseToken)
+      }
+    } catch (cleanupError) {
+      logger.error('Failed to compensate attachment persistence', { err: cleanupError })
+    }
     return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
   }
 
@@ -537,8 +658,8 @@ async function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: strin
       return Number.isFinite(parsed) ? parsed : 0
     }
     return 0
-  } catch {
-    return 0
+  } catch (error) {
+    throw new Error('Attachment quota accounting is unavailable.', { cause: error })
   }
 }
 

package/src/modules/attachments/backend/config/attachments/page.tsx

@@ -23,7 +23,7 @@ export default async function AttachmentsConfigurationPage() {
     <Page>
       <PageBody className="space-y-6">
         {partitionsLocked ? (
-          <Alert variant="warning">
+          <Alert status="warning">
             <AlertTitle>{lockedTitle}</AlertTitle>
             <AlertDescription>
               {lockedDescription}{' '}

package/src/modules/attachments/data/entities.ts

@@ -99,3 +99,62 @@ export class Attachment {
   @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
   createdAt: Date = new Date()
 }
+
+@Entity({ tableName: 'attachment_quota_reservations' })
+@Unique({
+  name: 'attachment_quota_reservations_scope_path_unique',
+  properties: ['tenantId', 'storageDriver', 'storagePath'],
+})
+@Index({
+  name: 'attachment_quota_reservations_tenant_status_idx',
+  properties: ['tenantId', 'status'],
+})
+export class AttachmentQuotaReservation {
+  [OptionalProps]?: 'actualBytes' | 'createdAt' | 'status' | 'updatedAt' | 'uploadTokenHash'
+
+  @PrimaryKey({ type: 'uuid' })
+  id!: string
+
+  @Property({ name: 'tenant_id', type: 'uuid' })
+  tenantId!: string
+
+  @Property({ name: 'organization_id', type: 'uuid' })
+  organizationId!: string
+
+  @Property({ name: 'reserved_bytes', type: 'bigint' })
+  reservedBytes!: number
+
+  @Property({ name: 'actual_bytes', type: 'bigint', nullable: true })
+  actualBytes?: number | null
+
+  @Property({ type: 'text', default: 'reserved' })
+  status: 'reserved' | 'storing' | 'stored' | 'recovering' | 'committed' = 'reserved'
+
+  @Property({ type: 'text' })
+  source!: string
+
+  @Property({ name: 'storage_driver', type: 'text' })
+  storageDriver!: string
+
+  @Property({ name: 'partition_code', type: 'text', nullable: true })
+  partitionCode?: string | null
+
+  @Property({ name: 'storage_path', type: 'text' })
+  storagePath!: string
+
+  @Property({ name: 'lease_token', type: 'uuid' })
+  leaseToken!: string
+
+  @Property({ name: 'upload_token_hash', type: 'text', nullable: true })
+  uploadTokenHash?: string | null
+
+  @Property({ name: 'expires_at', type: Date, nullable: true })
+  @Index({ name: 'attachment_quota_reservations_expires_idx' })
+  expiresAt?: Date | null
+
+  @Property({ name: 'created_at', type: Date, onCreate: () => new Date() })
+  createdAt: Date = new Date()
+
+  @Property({ name: 'updated_at', type: Date, onUpdate: () => new Date() })
+  updatedAt: Date = new Date()
+}

package/src/modules/attachments/di.ts

@@ -1,9 +1,17 @@
-import { asFunction } from 'awilix'
+import { asFunction, asValue } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import { StorageDriverFactory } from './lib/drivers/driverFactory'
+import { createAttachmentQuotaService } from './lib/quota-service'
+import { scheduleAttachmentQuotaRecovery } from './lib/quota-recovery-queue'
 
 export function register(container: AppContainer) {
   container.register({
+    attachmentQuotaRecoveryScheduler: asValue(scheduleAttachmentQuotaRecovery),
+    attachmentQuotaService: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>
+      createAttachmentQuotaService(em),
+    )
+      .scoped()
+      .proxy(),
     storageDriverFactory: asFunction(({ em }: { em: ConstructorParameters<typeof StorageDriverFactory>[0] }) =>
       new StorageDriverFactory(em),
     )

package/src/modules/attachments/fields/attachment.tsx

@@ -162,7 +162,7 @@ export const AttachmentInput = ({
           />
         </div>
       )}
-      {error ? <div className="text-xs text-red-600">{error}</div> : null}
+      {error ? <div className="text-xs text-status-error-text">{error}</div> : null}
       <div className="space-y-1">
         {loading ? <div className="text-xs text-muted-foreground">{t('attachments.library.loading', 'Loading attachments…')}</div> : null}
         {items.map(it => (

package/src/modules/attachments/i18n/de.json

@@ -4,7 +4,10 @@
   "attachments.errors.maxUploadSize": "Der Anhang überschreitet die maximal zulässige Upload-Größe.",
   "attachments.errors.publicPartitionBlocked": "Öffentliche Speicherpartitionen können für diesen Upload nicht explizit ausgewählt werden.",
   "attachments.errors.quotaExceeded": "Das Speicherlimit für Anhänge dieses Tenants wurde überschritten.",
+  "attachments.errors.quotaRecoveryUnsupported": "Der Speichertreiber kann nicht an der Kontingent-Wiederherstellung teilnehmen.",
+  "attachments.errors.quotaUnavailable": "Die Speicherkontingent-Abrechnung ist nicht verfügbar.",
   "attachments.errors.selectOrganization": "Wählen Sie eine bestimmte Organisation aus, bevor Sie einen Anhang hochladen.",
+  "attachments.errors.storagePathExists": "Der Zielspeicherpfad existiert bereits.",
   "attachments.library.actions.copied": "Link kopiert.",
   "attachments.library.actions.copyError": "Link konnte nicht kopiert werden.",
   "attachments.library.actions.copyUrl": "URL kopieren",
@@ -110,6 +113,9 @@
   "attachments.partitions.errors.delete": "Partition konnte nicht gelöscht werden.",
   "attachments.partitions.errors.load": "Partitionen konnten nicht geladen werden.",
   "attachments.partitions.errors.required": "Code und Titel sind erforderlich.",
+  "attachments.partitions.errors.s3BucketRequired": "Der Bucket ist erforderlich, wenn eine separate Zugangsdatenquelle verwendet wird.",
+  "attachments.partitions.errors.s3Disabled": "Diese Partition verwendet S3, aber S3 ist deaktiviert. Setze OM_ENABLE_STORAGE_S3=true und starte die Anwendung neu.",
+  "attachments.partitions.errors.s3EnvPrefixRequired": "Das Präfix der Umgebungsvariablen ist erforderlich, wenn eine separate Zugangsdatenquelle verwendet wird.",
   "attachments.partitions.errors.save": "Partition konnte nicht gespeichert werden.",
   "attachments.partitions.form.codeLabel": "Code",
   "attachments.partitions.form.codePlaceholder": "z. B. marketingAssets",
@@ -125,16 +131,25 @@
   "attachments.partitions.form.publicLabel": "Öffentlich zugänglich",
   "attachments.partitions.form.s3BucketLabel": "Bucket",
   "attachments.partitions.form.s3BucketOverrideLabel": "Bucket überschreiben (optional)",
+  "attachments.partitions.form.s3BucketOverridePlaceholder": "Leer lassen, um den Bucket der Integration zu verwenden",
   "attachments.partitions.form.s3ConfigTitle": "S3-Konfiguration",
+  "attachments.partitions.form.s3CredsPrefixHelp": "Liest {PREFIX}_ACCESS_KEY_ID und {PREFIX}_SECRET_ACCESS_KEY aus den Umgebungsvariablen.",
   "attachments.partitions.form.s3CredsPrefixLabel": "Präfix für Zugangsdaten-Umgebungsvariablen",
+  "attachments.partitions.form.s3CredsSourceEnv": "Separate Zugangsdaten aus Umgebungsvariablen verwenden",
+  "attachments.partitions.form.s3CredsSourceEnvHelp": "Diese Partition verwendet eigene Zugangsdaten aus Umgebungsvariablen. Die Zugangsdaten der Integration werden ignoriert. Bucket und Zugangsdaten-Präfix sind erforderlich.",
+  "attachments.partitions.form.s3CredsSourceIntegration": "Zugangsdaten aus dem Integrations-Marktplatz verwenden",
+  "attachments.partitions.form.s3CredsSourceIntegrationHelp": "Diese Partition verwendet die in der S3-Integration konfigurierten Zugangsdaten, Bucket, Region und Endpoint. Überschreibe einzelne Felder unten nur bei Bedarf.",
   "attachments.partitions.form.s3CredsSourceLabel": "Quelle der Zugangsdaten",
   "attachments.partitions.form.s3EndpointHelp": "Für AWS S3 leer lassen. Erforderlich für MinIO, DigitalOcean Spaces usw.",
   "attachments.partitions.form.s3EndpointLabel": "Benutzerdefinierter Endpoint",
   "attachments.partitions.form.s3EndpointOverrideLabel": "Benutzerdefinierten Endpoint überschreiben (optional)",
+  "attachments.partitions.form.s3EndpointOverridePlaceholder": "Leer lassen, um den Endpoint der Integration zu verwenden",
   "attachments.partitions.form.s3ForcePathStyleLabel": "Path-Style erzwingen (für MinIO erforderlich)",
   "attachments.partitions.form.s3RegionLabel": "Region",
   "attachments.partitions.form.s3RegionOverrideLabel": "Region überschreiben (optional)",
+  "attachments.partitions.form.s3RegionOverridePlaceholder": "Leer lassen, um die Region der Integration zu verwenden",
   "attachments.partitions.form.storageDriverLabel": "Speichertreiber",
+  "attachments.partitions.form.storageDriverS3DisabledHelp": "S3 ist deaktiviert. Setze OM_ENABLE_STORAGE_S3=true und starte neu, um S3-Partitionen zu aktivieren.",
   "attachments.partitions.form.titleLabel": "Titel",
   "attachments.partitions.form.titlePlaceholder": "z. B. Marketing-Assets",
   "attachments.partitions.locked.description": "Anhang-Partitionen werden durch Umgebungsstandardwerte verwaltet, solange der Demo- oder Onboarding-Modus aktiv ist.",

package/src/modules/attachments/i18n/en.json

@@ -4,7 +4,10 @@
   "attachments.errors.maxUploadSize": "Attachment exceeds the maximum upload size.",
   "attachments.errors.publicPartitionBlocked": "Public storage partitions cannot be selected explicitly for this upload.",
   "attachments.errors.quotaExceeded": "Attachment storage quota exceeded for this tenant.",
+  "attachments.errors.quotaRecoveryUnsupported": "Storage driver cannot participate in quota recovery.",
+  "attachments.errors.quotaUnavailable": "Storage quota accounting is unavailable.",
   "attachments.errors.selectOrganization": "Select a specific organization before uploading an attachment.",
+  "attachments.errors.storagePathExists": "The target storage path already exists.",
   "attachments.library.actions.copied": "Link copied.",
   "attachments.library.actions.copyError": "Unable to copy link.",
   "attachments.library.actions.copyUrl": "Copy URL",
@@ -110,6 +113,9 @@
   "attachments.partitions.errors.delete": "Failed to delete partition.",
   "attachments.partitions.errors.load": "Failed to load partitions.",
   "attachments.partitions.errors.required": "Code and title are required.",
+  "attachments.partitions.errors.s3BucketRequired": "Bucket is required when using a separate credentials source.",
+  "attachments.partitions.errors.s3Disabled": "This partition uses S3, but S3 is disabled. Set OM_ENABLE_STORAGE_S3=true and restart the app.",
+  "attachments.partitions.errors.s3EnvPrefixRequired": "Credentials env prefix is required when using a separate credentials source.",
   "attachments.partitions.errors.save": "Failed to save partition.",
   "attachments.partitions.form.codeLabel": "Code",
   "attachments.partitions.form.codePlaceholder": "e.g. marketingAssets",
@@ -125,16 +131,25 @@
   "attachments.partitions.form.publicLabel": "Publicly accessible",
   "attachments.partitions.form.s3BucketLabel": "Bucket",
   "attachments.partitions.form.s3BucketOverrideLabel": "Bucket override (optional)",
+  "attachments.partitions.form.s3BucketOverridePlaceholder": "Leave empty to use integration bucket",
   "attachments.partitions.form.s3ConfigTitle": "S3 Configuration",
+  "attachments.partitions.form.s3CredsPrefixHelp": "Reads {PREFIX}_ACCESS_KEY_ID and {PREFIX}_SECRET_ACCESS_KEY from environment variables.",
   "attachments.partitions.form.s3CredsPrefixLabel": "Credentials Env Prefix",
+  "attachments.partitions.form.s3CredsSourceEnv": "Use separate env-based credentials",
+  "attachments.partitions.form.s3CredsSourceEnvHelp": "This partition uses its own credentials read from environment variables. The integration credentials are ignored. Bucket and credentials prefix are required.",
+  "attachments.partitions.form.s3CredsSourceIntegration": "Use Integration Marketplace credentials",
+  "attachments.partitions.form.s3CredsSourceIntegrationHelp": "This partition reuses the credentials, bucket, region and endpoint configured in the S3 integration. Override individual fields below only when needed.",
   "attachments.partitions.form.s3CredsSourceLabel": "Credentials source",
   "attachments.partitions.form.s3EndpointHelp": "Leave empty for AWS S3. Required for MinIO, DigitalOcean Spaces, etc.",
   "attachments.partitions.form.s3EndpointLabel": "Custom Endpoint",
   "attachments.partitions.form.s3EndpointOverrideLabel": "Custom endpoint override (optional)",
+  "attachments.partitions.form.s3EndpointOverridePlaceholder": "Leave empty to use integration endpoint",
   "attachments.partitions.form.s3ForcePathStyleLabel": "Force Path Style (required for MinIO)",
   "attachments.partitions.form.s3RegionLabel": "Region",
   "attachments.partitions.form.s3RegionOverrideLabel": "Region override (optional)",
+  "attachments.partitions.form.s3RegionOverridePlaceholder": "Leave empty to use integration region",
   "attachments.partitions.form.storageDriverLabel": "Storage Driver",
+  "attachments.partitions.form.storageDriverS3DisabledHelp": "S3 is disabled. Set OM_ENABLE_STORAGE_S3=true and restart to enable S3 partitions.",
   "attachments.partitions.form.titleLabel": "Title",
   "attachments.partitions.form.titlePlaceholder": "e.g. Marketing assets",
   "attachments.partitions.locked.description": "Attachment partitions are managed by environment defaults while demo or onboarding mode is enabled.",

package/src/modules/attachments/i18n/es.json

@@ -4,7 +4,10 @@
   "attachments.errors.maxUploadSize": "El archivo adjunto supera el tamaño máximo de carga permitido.",
   "attachments.errors.publicPartitionBlocked": "No se pueden seleccionar explícitamente particiones de almacenamiento públicas para esta carga.",
   "attachments.errors.quotaExceeded": "Se superó la cuota de almacenamiento de adjuntos para este tenant.",
+  "attachments.errors.quotaRecoveryUnsupported": "El controlador de almacenamiento no puede participar en la recuperación de cuota.",
+  "attachments.errors.quotaUnavailable": "La contabilidad de la cuota de almacenamiento no está disponible.",
   "attachments.errors.selectOrganization": "Selecciona una organización específica antes de subir un adjunto.",
+  "attachments.errors.storagePathExists": "La ruta de almacenamiento de destino ya existe.",
   "attachments.library.actions.copied": "Enlace copiado.",
   "attachments.library.actions.copyError": "No se pudo copiar el enlace.",
   "attachments.library.actions.copyUrl": "Copiar URL",
@@ -110,6 +113,9 @@
   "attachments.partitions.errors.delete": "No se pudo eliminar la partición.",
   "attachments.partitions.errors.load": "No se pudieron cargar las particiones.",
   "attachments.partitions.errors.required": "El código y el título son obligatorios.",
+  "attachments.partitions.errors.s3BucketRequired": "El bucket es obligatorio cuando se usa una fuente de credenciales independiente.",
+  "attachments.partitions.errors.s3Disabled": "Esta partición usa S3, pero S3 está desactivado. Configura OM_ENABLE_STORAGE_S3=true y reinicia la aplicación.",
+  "attachments.partitions.errors.s3EnvPrefixRequired": "El prefijo de variables de entorno es obligatorio cuando se usa una fuente de credenciales independiente.",
   "attachments.partitions.errors.save": "No se pudo guardar la partición.",
   "attachments.partitions.form.codeLabel": "Código",
   "attachments.partitions.form.codePlaceholder": "ej. marketingAssets",
@@ -125,16 +131,25 @@
   "attachments.partitions.form.publicLabel": "Acceso público",
   "attachments.partitions.form.s3BucketLabel": "Bucket",
   "attachments.partitions.form.s3BucketOverrideLabel": "Sobrescribir bucket (opcional)",
+  "attachments.partitions.form.s3BucketOverridePlaceholder": "Déjalo vacío para usar el bucket de la integración",
   "attachments.partitions.form.s3ConfigTitle": "Configuración S3",
+  "attachments.partitions.form.s3CredsPrefixHelp": "Lee {PREFIX}_ACCESS_KEY_ID y {PREFIX}_SECRET_ACCESS_KEY de las variables de entorno.",
   "attachments.partitions.form.s3CredsPrefixLabel": "Prefijo de variables de entorno de credenciales",
+  "attachments.partitions.form.s3CredsSourceEnv": "Usar credenciales independientes basadas en el entorno",
+  "attachments.partitions.form.s3CredsSourceEnvHelp": "Esta partición usa sus propias credenciales leídas de variables de entorno. Las credenciales de la integración se ignoran. El bucket y el prefijo de credenciales son obligatorios.",
+  "attachments.partitions.form.s3CredsSourceIntegration": "Usar credenciales del Marketplace de integraciones",
+  "attachments.partitions.form.s3CredsSourceIntegrationHelp": "Esta partición reutiliza las credenciales, el bucket, la región y el endpoint configurados en la integración de S3. Anula los campos individuales de abajo solo cuando sea necesario.",
   "attachments.partitions.form.s3CredsSourceLabel": "Origen de credenciales",
   "attachments.partitions.form.s3EndpointHelp": "Déjelo vacío para AWS S3. Es obligatorio para MinIO, DigitalOcean Spaces, etc.",
   "attachments.partitions.form.s3EndpointLabel": "Endpoint personalizado",
   "attachments.partitions.form.s3EndpointOverrideLabel": "Sobrescribir endpoint personalizado (opcional)",
+  "attachments.partitions.form.s3EndpointOverridePlaceholder": "Déjalo vacío para usar el endpoint de la integración",
   "attachments.partitions.form.s3ForcePathStyleLabel": "Forzar Path Style (obligatorio para MinIO)",
   "attachments.partitions.form.s3RegionLabel": "Región",
   "attachments.partitions.form.s3RegionOverrideLabel": "Sobrescribir región (opcional)",
+  "attachments.partitions.form.s3RegionOverridePlaceholder": "Déjalo vacío para usar la región de la integración",
   "attachments.partitions.form.storageDriverLabel": "Controlador de almacenamiento",
+  "attachments.partitions.form.storageDriverS3DisabledHelp": "S3 está desactivado. Configura OM_ENABLE_STORAGE_S3=true y reinicia para habilitar particiones S3.",
   "attachments.partitions.form.titleLabel": "Título",
   "attachments.partitions.form.titlePlaceholder": "ej. Recursos de marketing",
   "attachments.partitions.locked.description": "Las particiones de archivos adjuntos están administradas por valores predeterminados del entorno mientras el modo demo o de incorporación está activo.",

package/src/modules/attachments/i18n/ko.json

@@ -0,0 +1,175 @@
+{
+  "attachments.errors.activeContentBlocked": "활성 콘텐츠 업로드는 허용되지 않습니다.",
+  "attachments.errors.dangerousExecutable": "실행 파일 형식은 첨부 파일로 허용되지 않습니다.",
+  "attachments.errors.maxUploadSize": "첨부 파일이 최대 업로드 크기를 초과합니다.",
+  "attachments.errors.publicPartitionBlocked": "이 업로드에는 공개 저장소 파티션을 명시적으로 선택할 수 없습니다.",
+  "attachments.errors.quotaExceeded": "이 테넌트의 첨부 파일 저장소 할당량을 초과했습니다.",
+  "attachments.errors.quotaRecoveryUnsupported": "저장 용량 복구가 지원되지 않습니다.",
+  "attachments.errors.quotaUnavailable": "첨부파일 저장 용량 정보를 확인할 수 없습니다.",
+  "attachments.errors.selectOrganization": "첨부파일을 업로드하기 전에 특정 조직을 선택하세요.",
+  "attachments.errors.storagePathExists": "대상 저장 경로가 이미 존재합니다.",
+  "attachments.library.actions.copied": "링크가 복사되었습니다.",
+  "attachments.library.actions.copyError": "링크를 복사할 수 없습니다.",
+  "attachments.library.actions.copyUrl": "URL 복사",
+  "attachments.library.actions.delete": "삭제",
+  "attachments.library.actions.edit": "메타데이터 편집",
+  "attachments.library.actions.open": "열기",
+  "attachments.library.actions.refresh": "새로고침",
+  "attachments.library.actions.upload": "업로드",
+  "attachments.library.confirm.delete": "첨부 파일 \"{{name}}\"을(를) 삭제하시겠습니까? 이 작업은 되돌릴 수 없습니다.",
+  "attachments.library.delete": "첨부 파일 삭제",
+  "attachments.library.description": "이 워크스페이스에 저장된 모든 파일을 찾아보고, 태그를 지정하고, 관리하세요.",
+  "attachments.library.errors.delete": "첨부 파일 삭제에 실패했습니다.",
+  "attachments.library.errors.load": "첨부 파일을 불러오지 못했습니다.",
+  "attachments.library.filters.partition": "파티션",
+  "attachments.library.filters.tags": "태그",
+  "attachments.library.filters.tagsPlaceholder": "태그로 필터링",
+  "attachments.library.loadMore": "더 보기",
+  "attachments.library.loading": "첨부 파일을 불러오는 중…",
+  "attachments.library.messages.deleted": "첨부 파일이 제거되었습니다.",
+  "attachments.library.metadata.assignments.add": "할당 추가",
+  "attachments.library.metadata.assignments.description": "이 첨부 파일이 속한 레코드를 선택적 링크와 함께 추가하세요.",
+  "attachments.library.metadata.assignments.href": "링크",
+  "attachments.library.metadata.assignments.id": "레코드 ID",
+  "attachments.library.metadata.assignments.label": "라벨",
+  "attachments.library.metadata.assignments.remove": "제거",
+  "attachments.library.metadata.assignments.title": "할당",
+  "attachments.library.metadata.assignments.type": "유형",
+  "attachments.library.metadata.cancel": "취소",
+  "attachments.library.metadata.details": "상세 정보",
+  "attachments.library.metadata.download": "다운로드",
+  "attachments.library.metadata.error": "메타데이터 업데이트에 실패했습니다.",
+  "attachments.library.metadata.extractedTitle": "추출된 텍스트",
+  "attachments.library.metadata.loadError": "첨부 파일 메타데이터를 불러오지 못했습니다.",
+  "attachments.library.metadata.loading": "메타데이터를 불러오는 중…",
+  "attachments.library.metadata.noContent": "추출된 텍스트 없음",
+  "attachments.library.metadata.noSelection": "편집할 첨부 파일을 선택하세요.",
+  "attachments.library.metadata.preview": "미리보기",
+  "attachments.library.metadata.previewUnavailable": "이 파일 형식은 미리보기를 사용할 수 없습니다.",
+  "attachments.library.metadata.resizeTool.copied": "이미지 URL이 복사되었습니다.",
+  "attachments.library.metadata.resizeTool.copy": "URL 복사",
+  "attachments.library.metadata.resizeTool.copyError": "URL을 복사할 수 없습니다.",
+  "attachments.library.metadata.resizeTool.height": "높이 (px)",
+  "attachments.library.metadata.resizeTool.missing": "URL을 생성하려면 너비 또는 높이를 입력하세요.",
+  "attachments.library.metadata.resizeTool.title": "크기 조정된 URL 생성",
+  "attachments.library.metadata.resizeTool.width": "너비 (px)",
+  "attachments.library.metadata.save": "저장",
+  "attachments.library.metadata.saving": "저장 중…",
+  "attachments.library.metadata.showLess": "간략히 보기",
+  "attachments.library.metadata.showMore": "더 보기",
+  "attachments.library.metadata.source": "소스",
+  "attachments.library.metadata.success": "첨부 파일이 업데이트되었습니다.",
+  "attachments.library.metadata.tagsPlaceholder": "태그 추가",
+  "attachments.library.metadata.title": "첨부 파일 메타데이터 편집",
+  "attachments.library.open": "첨부 파일 상세 정보 열기",
+  "attachments.library.openMetadata": "{name}의 첨부 파일 상세 정보 열기",
+  "attachments.library.table.assignments": "할당",
+  "attachments.library.table.created": "생성됨",
+  "attachments.library.table.download": "다운로드",
+  "attachments.library.table.empty": "첨부 파일을 찾을 수 없습니다.",
+  "attachments.library.table.file": "파일",
+  "attachments.library.table.partition": "파티션",
+  "attachments.library.table.search": "파일 검색…",
+  "attachments.library.table.tags": "태그",
+  "attachments.library.title": "첨부 파일",
+  "attachments.library.upload.assignments.add": "할당 추가",
+  "attachments.library.upload.assignments.description": "지금 이 파일을 기존 레코드에 연결하거나 나중에 추가할 수 있습니다.",
+  "attachments.library.upload.assignments.href": "링크",
+  "attachments.library.upload.assignments.id": "레코드 ID",
+  "attachments.library.upload.assignments.label": "라벨",
+  "attachments.library.upload.assignments.remove": "제거",
+  "attachments.library.upload.assignments.title": "할당",
+  "attachments.library.upload.assignments.type": "유형",
+  "attachments.library.upload.cancel": "취소",
+  "attachments.library.upload.choose": "파일 선택",
+  "attachments.library.upload.dropHint": "여기에 파일을 끌어다 놓거나 클릭하여 업로드하세요.",
+  "attachments.library.upload.failed": "업로드에 실패했습니다.",
+  "attachments.library.upload.file": "파일",
+  "attachments.library.upload.fileRequired": "업로드할 파일을 선택하세요.",
+  "attachments.library.upload.noFiles": "아직 선택된 파일이 없습니다.",
+  "attachments.library.upload.partition": "파티션",
+  "attachments.library.upload.partitionDefault": "기본값 (비공개)",
+  "attachments.library.upload.progressLabel": "파일 업로드 중",
+  "attachments.library.upload.saveFirst": "파일을 업로드하기 전에 레코드를 저장하세요.",
+  "attachments.library.upload.submit": "업로드",
+  "attachments.library.upload.submitting": "업로드 중…",
+  "attachments.library.upload.success": "첨부 파일이 업로드되었습니다.",
+  "attachments.library.upload.tagsPlaceholder": "태그 추가",
+  "attachments.library.upload.title": "첨부 파일 업로드",
+  "attachments.nav.group": "메디아",
+  "attachments.partitions.actions.add": "파티션 추가",
+  "attachments.partitions.actions.cancel": "취소",
+  "attachments.partitions.actions.create": "파티션 생성",
+  "attachments.partitions.actions.delete": "삭제",
+  "attachments.partitions.actions.edit": "편집",
+  "attachments.partitions.actions.refresh": "새로고침",
+  "attachments.partitions.actions.save": "변경 사항 저장",
+  "attachments.partitions.confirm.delete": "파티션 \"{{code}}\"을(를) 삭제하시겠습니까?",
+  "attachments.partitions.description": "업로드를 위한 저장소 파티션과 공개 범위를 정의합니다.",
+  "attachments.partitions.dialog.createDescription": "첨부 파일용 저장소 파티션을 정의합니다.",
+  "attachments.partitions.dialog.createTitle": "파티션 생성",
+  "attachments.partitions.dialog.editDescription": "파티션 메타데이터와 공개 범위를 업데이트합니다.",
+  "attachments.partitions.dialog.editTitle": "파티션 편집",
+  "attachments.partitions.errors.delete": "파티션 삭제에 실패했습니다.",
+  "attachments.partitions.errors.load": "파티션을 불러오지 못했습니다.",
+  "attachments.partitions.errors.required": "코드와 제목은 필수입니다.",
+  "attachments.partitions.errors.s3BucketRequired": "별도의 자격 증명 소스를 사용하는 경우 버킷이 필요합니다.",
+  "attachments.partitions.errors.s3Disabled": "이 파티션은 S3를 사용하지만 S3는 비활성화되어 있습니다. OM_ENABLE_STORAGE_S3=true로 설정하고 앱을 다시 시작하세요.",
+  "attachments.partitions.errors.s3EnvPrefixRequired": "별도의 자격 증명 소스를 사용하는 경우 자격 증명 env 접두사가 필요합니다.",
+  "attachments.partitions.errors.save": "파티션 저장에 실패했습니다.",
+  "attachments.partitions.form.codeLabel": "코드",
+  "attachments.partitions.form.codePlaceholder": "예: marketingAssets",
+  "attachments.partitions.form.descriptionLabel": "설명",
+  "attachments.partitions.form.descriptionPlaceholder": "이 파티션이 어떻게 사용되는지 설명하세요.",
+  "attachments.partitions.form.envKeyHelp": "저장소 경로를 재정의하려면 이 환경 변수를 설정하세요:",
+  "attachments.partitions.form.ocrLabel": "OCR/텍스트 추출 필요",
+  "attachments.partitions.form.ocrModelHelp": "이미지 및 PDF OCR에 사용할 LLM 모델을 선택하세요. OCR_MODEL 환경 변수 또는 gpt-4o로 대체됩니다. LLM OCR을 사용할 수 없으면 PDF는 순수 JS 텍스트 추출(pdfjs-dist)로, DOCX 파일은 순수 JS 추출(mammoth)로 대체됩니다.",
+  "attachments.partitions.form.ocrModelLabel": "OCR 모델",
+  "attachments.partitions.form.ocrModelOptions.default": "기본값 (환경에서)",
+  "attachments.partitions.form.ocrModelOptions.gpt-4o": "GPT-4o (권장)",
+  "attachments.partitions.form.ocrModelOptions.gpt-4o-mini": "GPT-4o Mini (더 빠르고 저렴함)",
+  "attachments.partitions.form.publicLabel": "공개 접근 가능",
+  "attachments.partitions.form.s3BucketLabel": "버킷",
+  "attachments.partitions.form.s3BucketOverrideLabel": "버킷 재정의 (선택 사항)",
+  "attachments.partitions.form.s3BucketOverridePlaceholder": "통합 버킷을 사용하려면 비워 두세요.",
+  "attachments.partitions.form.s3ConfigTitle": "S3 구성",
+  "attachments.partitions.form.s3CredsPrefixHelp": "환경 변수에서 {PREFIX}_ACCESS_KEY_ID 및 {PREFIX}_SECRET_ACCESS_KEY를 읽습니다.",
+  "attachments.partitions.form.s3CredsPrefixLabel": "자격 증명 환경 변수 접두사",
+  "attachments.partitions.form.s3CredsSourceEnv": "별도의 환경 기반 자격 증명 사용",
+  "attachments.partitions.form.s3CredsSourceEnvHelp": "이 파티션은 환경 변수에서 읽은 자체 자격 증명을 사용합니다. 통합 자격 증명은 무시됩니다. 버킷 및 자격 증명 접두사가 필요합니다.",
+  "attachments.partitions.form.s3CredsSourceIntegration": "Integration Marketplace 자격 증명 사용",
+  "attachments.partitions.form.s3CredsSourceIntegrationHelp": "이 파티션은 S3 통합에 구성된 자격 증명, 버킷, 지역 및 엔드포인트를 재사용합니다. 필요한 경우에만 아래의 개별 필드를 재정의하세요.",
+  "attachments.partitions.form.s3CredsSourceLabel": "자격 증명 소스",
+  "attachments.partitions.form.s3EndpointHelp": "AWS S3의 경우 비워두세요. MinIO, DigitalOcean Spaces 등에는 필수입니다.",
+  "attachments.partitions.form.s3EndpointLabel": "커스텀 엔드포인트",
+  "attachments.partitions.form.s3EndpointOverrideLabel": "커스텀 엔드포인트 재정의 (선택 사항)",
+  "attachments.partitions.form.s3EndpointOverridePlaceholder": "통합 엔드포인트를 사용하려면 비워 두세요.",
+  "attachments.partitions.form.s3ForcePathStyleLabel": "경로 스타일 강제 (MinIO에 필요)",
+  "attachments.partitions.form.s3RegionLabel": "리전",
+  "attachments.partitions.form.s3RegionOverrideLabel": "리전 재정의 (선택 사항)",
+  "attachments.partitions.form.s3RegionOverridePlaceholder": "통합 지역을 사용하려면 비워두세요.",
+  "attachments.partitions.form.storageDriverLabel": "저장소 드라이버",
+  "attachments.partitions.form.storageDriverS3DisabledHelp": "S3가 비활성화되었습니다. OM_ENABLE_STORAGE_S3=true로 설정하고 다시 시작하여 S3 파티션을 활성화합니다.",
+  "attachments.partitions.form.titleLabel": "제목",
+  "attachments.partitions.form.titlePlaceholder": "예: 마케팅 자산",
+  "attachments.partitions.locked.description": "데모 또는 온보딩 모드가 활성화된 동안 첨부 파일 파티션은 환경 기본값으로 관리됩니다.",
+  "attachments.partitions.locked.hint": "앱 내 구성을 다시 활성화하려면 아래 환경 변수를 업데이트하세요.",
+  "attachments.partitions.locked.title": "파티션 설정이 잠겨 있습니다",
+  "attachments.partitions.messages.created": "파티션이 생성되었습니다.",
+  "attachments.partitions.messages.deleted": "파티션이 제거되었습니다.",
+  "attachments.partitions.messages.updated": "파티션이 업데이트되었습니다.",
+  "attachments.partitions.nav.title": "첨부 파일",
+  "attachments.partitions.table.code": "코드",
+  "attachments.partitions.table.description": "설명",
+  "attachments.partitions.table.empty": "구성된 파티션이 없습니다.",
+  "attachments.partitions.table.envKey": "환경 변수",
+  "attachments.partitions.table.ocr": "OCR",
+  "attachments.partitions.table.private": "비공개",
+  "attachments.partitions.table.public": "공개",
+  "attachments.partitions.table.search": "파티션 검색…",
+  "attachments.partitions.table.storageDriver": "저장소",
+  "attachments.partitions.table.title": "제목",
+  "attachments.partitions.table.visibility": "공개 범위",
+  "attachments.partitions.title": "첨부 파일 파티션",
+  "attachments.storage.nav.title": "저장소"
+}