@open-mercato/storage-s3 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/modules/storage_s3/__tests__/s3Driver.test.ts

@@ -99,6 +99,10 @@ describe('S3StorageDriver', () => {
       new S3StorageDriver(BASE_CONFIG)
       const [[arg]] = (S3Client as jest.Mock).mock.calls
       expect(arg.credentials).toBeUndefined()
+      expect(arg.requestHandler).toEqual(expect.objectContaining({
+        connectionTimeout: 10_000,
+        requestTimeout: 120_000,
+      }))
     })
 
     it('applies forcePathStyle and custom endpoint', () => {
@@ -107,6 +111,17 @@ describe('S3StorageDriver', () => {
       expect(arg.endpoint).toBe('http://minio:9000')
       expect(arg.forcePathStyle).toBe(true)
     })
+
+    it('rejects link-local custom endpoints before constructing an S3 client', () => {
+      expect(() => {
+        new S3StorageDriver({
+          ...BASE_CONFIG,
+          endpoint: 'http://169.254.169.254/latest/meta-data/',
+          forcePathStyle: true,
+        })
+      }).toThrow(/private or reserved IP range/i)
+      expect(S3Client).not.toHaveBeenCalled()
+    })
   })
 
   describe('store()', () => {
@@ -198,7 +213,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.read('', 'docs/org_org-victim/tenant_tenant-owned/secret.txt'),
-      ).rejects.toThrow('S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -229,7 +244,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.read('docs', 'exports/org_o/tenant_t/file.txt'),
-      ).rejects.toThrow('S3 key is not scoped to the requested partition')
+      ).rejects.toThrow('[internal] S3 key is not scoped to the requested partition')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -243,7 +258,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.read('', 'docs/org_org-victim/tenant_tenant-owned/org_org-owned/tenant_tenant-owned/private.txt'),
-      ).rejects.toThrow('S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -259,7 +274,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.putObject('docs/org_org-victim/tenant_tenant-owned/file.txt', Buffer.from('secret')),
-      ).rejects.toThrow('S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -291,7 +306,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.delete('', 'docs/org_org-owned/tenant_tenant-victim/file.txt'),
-      ).rejects.toThrow('S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -314,7 +329,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.delete('docs', 'exports/org_o/tenant_t/file.txt'),
-      ).rejects.toThrow('S3 key is not scoped to the requested partition')
+      ).rejects.toThrow('[internal] S3 key is not scoped to the requested partition')
 
       expect(mockSend).not.toHaveBeenCalled()
     })
@@ -394,7 +409,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.getSignedUrl('docs/org_org-victim/tenant_tenant-owned/file.pdf', 'download'),
-      ).rejects.toThrow('S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
       expect(mockGetSignedUrl).not.toHaveBeenCalled()
     })
@@ -420,7 +435,7 @@ describe('S3StorageDriver', () => {
 
       await expect(
         driver.getSignedUrl('docs/org_shared/tenant_shared/shared.pdf', 'upload'),
-      ).rejects.toThrow('S3 key is not scoped to the active tenant')
+      ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
       expect(mockGetSignedUrl).not.toHaveBeenCalled()
     })

package/src/modules/storage_s3/__tests__/s3ListRoute.test.ts

@@ -9,6 +9,12 @@ jest.mock('@open-mercato/shared/lib/auth/server', () => ({
   getAuthFromRequest: async () => ({ tenantId, orgId, sub: null }),
 }))
 
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: async () => ({
+    t: (key: string) => `translated:${key}`,
+  }),
+}))
+
 jest.mock('@open-mercato/shared/lib/di/container', () => ({
   createRequestContainer: async () => ({
     resolve: (token: string) => {
@@ -69,7 +75,7 @@ describe('storage_s3 list route tenant scoping', () => {
 
     expect(response.status).toBe(403)
     await expect(response.json()).resolves.toEqual({
-      error: 'Access denied: prefix is not scoped to this tenant.',
+      error: 'translated:storage_s3.errors.prefixAccessDenied',
     })
     expect(listObjectsMock).not.toHaveBeenCalled()
   })

package/src/modules/storage_s3/__tests__/s3Routes.test.ts

@@ -5,6 +5,12 @@ jest.mock('@open-mercato/shared/lib/auth/server', () => ({
   getAuthFromRequest: (...args: unknown[]) => mockGetAuthFromRequest(...args),
 }))
 
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: async () => ({
+    t: (key: string) => `translated:${key}`,
+  }),
+}))
+
 const mockResolveCredentials = jest.fn()
 jest.mock('@open-mercato/shared/lib/di/container', () => ({
   createRequestContainer: jest.fn(async () => ({
@@ -93,9 +99,26 @@ describe('storage_s3 standalone route key scope', () => {
     }))
 
     expect(response.status).toBe(403)
+    await expect(response.json()).resolves.toEqual({
+      error: 'translated:storage_s3.errors.keyAccessDenied',
+    })
     expect(mockGetSignedUrl).not.toHaveBeenCalled()
   })
 
+  it('localizes invalid delete payload errors', async () => {
+    const response = await DELETE(new Request('http://example.test/api/storage-providers/s3/delete', {
+      method: 'DELETE',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({}),
+    }))
+
+    expect(response.status).toBe(400)
+    await expect(response.json()).resolves.toEqual({
+      error: 'translated:storage_s3.errors.invalidPayload',
+    })
+    expect(mockDelete).not.toHaveBeenCalled()
+  })
+
   it('deletes shared namespace objects for an authorized storage manager', async () => {
     mockDelete.mockResolvedValueOnce(undefined)
 
@@ -116,6 +139,9 @@ describe('storage_s3 standalone route key scope', () => {
       )
 
       expect(response.status).toBe(403)
+      await expect(response.json()).resolves.toEqual({
+        error: 'translated:storage_s3.errors.keyAccessDenied',
+      })
     }
     expect(mockRead).not.toHaveBeenCalled()
   })

package/src/modules/storage_s3/__tests__/storageService.test.ts

@@ -27,6 +27,21 @@ beforeEach(() => {
 })
 
 describe('createStorageService', () => {
+  it('preserves the configured path prefix for programmatic uploads', async () => {
+    mockSend.mockResolvedValueOnce({})
+    const service = createStorageService({ ...BASE_CONFIG, pathPrefix: 'backups/' })
+
+    const result = await service.upload({
+      namespace: 'docs',
+      fileName: 'report.pdf',
+      buffer: Buffer.from('pdf'),
+      scope: TENANT_SCOPE,
+    })
+
+    expect(result.key).toMatch(/^backups\/docs\/org_org-owned\/tenant_tenant-owned\//)
+    expect(mockSend.mock.calls[0]?.[0]?.Key).toBe(result.key)
+  })
+
   it('rejects cross-tenant downloads before calling S3', async () => {
     const service = createStorageService(BASE_CONFIG)
 
@@ -35,7 +50,7 @@ describe('createStorageService', () => {
         key: 'docs/org_org-victim/tenant_tenant-owned/file.txt',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
     expect(mockSend).not.toHaveBeenCalled()
   })
@@ -70,7 +85,7 @@ describe('createStorageService', () => {
         key: 'docs/org_org-victim/tenant_tenant-owned/file.txt',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
     expect(mockSend).not.toHaveBeenCalled()
   })
@@ -83,7 +98,7 @@ describe('createStorageService', () => {
         key: 'docs/org_org-owned/tenant_tenant-victim/file.txt',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
     expect(mockSend).not.toHaveBeenCalled()
   })
@@ -97,7 +112,7 @@ describe('createStorageService', () => {
         operation: 'download',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
     expect(mockGetSignedUrl).not.toHaveBeenCalled()
   })
@@ -111,7 +126,7 @@ describe('createStorageService', () => {
         operation: 'upload',
         scope: TENANT_SCOPE,
       }),
-    ).rejects.toThrow('S3 key is not scoped to the active tenant')
+    ).rejects.toThrow('[internal] S3 key is not scoped to the active tenant')
 
     expect(mockGetSignedUrl).not.toHaveBeenCalled()
   })

package/src/modules/storage_s3/__tests__/upload.test.ts

@@ -0,0 +1,93 @@
+/** @jest-environment node */
+
+const mockGetAuthFromRequest = jest.fn()
+jest.mock('@open-mercato/shared/lib/auth/server', () => ({
+  getAuthFromRequest: (...args: unknown[]) => mockGetAuthFromRequest(...args),
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
+  resolveTranslations: async () => ({
+    t: (key: string) => `translated:${key}`,
+  }),
+}))
+
+const mockResolveCredentials = jest.fn()
+const mockCreateRequestContainer = jest.fn(async () => ({
+  resolve: (key: string) => {
+    if (key === 'integrationCredentialsService') return { resolve: mockResolveCredentials }
+    throw new Error(`Unexpected dependency: ${key}`)
+  },
+}))
+jest.mock('@open-mercato/shared/lib/di/container', () => ({
+  createRequestContainer: () => mockCreateRequestContainer(),
+}))
+
+const mockListObjects = jest.fn()
+const mockPutObject = jest.fn()
+jest.mock('../lib/s3-driver', () => ({
+  S3StorageDriver: jest.fn().mockImplementation(() => ({
+    getBucket: () => 'test-bucket',
+    listObjects: (...args: unknown[]) => mockListObjects(...args),
+    putObject: (...args: unknown[]) => mockPutObject(...args),
+  })),
+}))
+
+import { POST } from '../api/post/storage-providers/s3/upload'
+
+describe('storage_s3 direct upload route', () => {
+  const originalMaxUploadMb = process.env.OM_ATTACHMENT_MAX_UPLOAD_MB
+
+  beforeEach(() => {
+    jest.clearAllMocks()
+    mockGetAuthFromRequest.mockResolvedValue({ tenantId: 'tenant-1', orgId: 'org-1' })
+    mockResolveCredentials.mockResolvedValue({ bucket: 'test-bucket', region: 'eu-central-1' })
+    mockListObjects.mockResolvedValue({ files: [], truncated: false })
+    mockPutObject.mockResolvedValue(undefined)
+    delete process.env.OM_ATTACHMENT_MAX_UPLOAD_MB
+  })
+
+  afterAll(() => {
+    if (originalMaxUploadMb === undefined) delete process.env.OM_ATTACHMENT_MAX_UPLOAD_MB
+    else process.env.OM_ATTACHMENT_MAX_UPLOAD_MB = originalMaxUploadMb
+  })
+
+  it('rejects oversized streamed metadata without trusting content length', async () => {
+    process.env.OM_ATTACHMENT_MAX_UPLOAD_MB = '0.000001'
+    const boundary = 'oversized-key'
+    const body = new TextEncoder().encode([
+      `--${boundary}\r\nContent-Disposition: form-data; name="key"\r\n\r\n`,
+      'x'.repeat(1024 * 1024),
+      `\r\n--${boundary}\r\nContent-Disposition: form-data; name="file"; filename="small.txt"\r\n`,
+      'Content-Type: text/plain\r\n\r\ns\r\n',
+      `--${boundary}--\r\n`,
+    ].join(''))
+    const request = new Request('http://example.test/api/storage-providers/s3/upload', {
+      method: 'POST',
+      headers: { 'content-type': `multipart/form-data; boundary=${boundary}` },
+      body,
+    })
+
+    expect(request.headers.get('content-length')).toBeNull()
+    const response = await POST(request)
+
+    expect(response.status).toBe(413)
+    await expect(response.json()).resolves.toEqual({
+      error: 'translated:storage_s3.errors.maxUploadSize',
+    })
+    expect(mockCreateRequestContainer).not.toHaveBeenCalled()
+    expect(mockPutObject).not.toHaveBeenCalled()
+  })
+
+  it('preserves valid multipart parsing for a normal upload', async () => {
+    const form = new FormData()
+    form.set('file', new File([new TextEncoder().encode('safe')], 'safe.txt', { type: 'text/plain' }))
+    const response = await POST(new Request('http://example.test/api/storage-providers/s3/upload', {
+      method: 'POST',
+      body: form,
+    }))
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toMatchObject({ bucket: 'test-bucket', size: 4 })
+    expect(mockPutObject).toHaveBeenCalledTimes(1)
+  })
+})

package/src/modules/storage_s3/api/delete/storage-providers/s3/delete.ts

@@ -3,8 +3,10 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { isS3KeyAddressableByScope } from '../../../../lib/key-scope'
 import { S3StorageDriver } from '../../../../lib/s3-driver'
+import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
 
 export const metadata = {
   path: '/storage-providers/s3/delete',
@@ -26,27 +28,42 @@ async function resolveDriver(tenantId: string, orgId: string): Promise<S3Storage
 }
 
 export async function DELETE(req: Request) {
+  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
 
   const json = await req.json().catch(() => null)
   const parsed = requestSchema.safeParse(json)
   if (!parsed.success) {
-    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.invalidPayload', 'Invalid payload') }, { status: 400 })
   }
 
   if (!isS3KeyAddressableByScope(parsed.data.key, auth.orgId, auth.tenantId)) {
-    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })
+    return NextResponse.json({ error: t('storage_s3.errors.keyAccessDenied', 'Access denied: key is not scoped to this tenant.') }, { status: 403 })
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
   }
 
-  await driver.delete('', parsed.data.key)
+  await (driver.deleteStrict?.('', parsed.data.key) ?? driver.delete('', parsed.data.key))
+  const { resolve } = await createRequestContainer()
+  let attachmentQuotaService: AttachmentQuotaService | null = null
+  try {
+    attachmentQuotaService = resolve('attachmentQuotaService') as AttachmentQuotaService | null
+  } catch {
+    // Backward-compatible when the attachments quota service is not registered.
+  }
+  if (attachmentQuotaService) {
+    await attachmentQuotaService.releaseCommittedByPath({
+      tenantId: auth.tenantId,
+      storageDriver: 's3',
+      storagePath: parsed.data.key,
+    })
+  }
   return new NextResponse(null, { status: 204 })
 }
 

package/src/modules/storage_s3/api/get/storage-providers/s3/download.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import {
   buildAttachmentContentDisposition,
   canRenderInlineAttachment,
@@ -27,23 +28,24 @@ async function resolveDriver(tenantId: string, orgId: string): Promise<S3Storage
 }
 
 export async function GET(req: Request) {
+  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
 
   const key = new URL(req.url).searchParams.get('key')
   if (!key) {
-    return NextResponse.json({ error: 'key query param is required' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.keyRequired', 'key query param is required') }, { status: 400 })
   }
 
   if (!isS3KeyAddressableByScope(key, auth.orgId, auth.tenantId)) {
-    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })
+    return NextResponse.json({ error: t('storage_s3.errors.keyAccessDenied', 'Access denied: key is not scoped to this tenant.') }, { status: 403 })
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
   }
 
   let buffer: Buffer
@@ -53,7 +55,7 @@ export async function GET(req: Request) {
     buffer = result.buffer
     contentType = result.contentType
   } catch {
-    return NextResponse.json({ error: 'File not found' }, { status: 404 })
+    return NextResponse.json({ error: t('storage_s3.errors.fileNotFound', 'File not found') }, { status: 404 })
   }
 
   const fileName = sanitizeUploadedFileName(key.split('/').pop() || 'download')

package/src/modules/storage_s3/api/get/storage-providers/s3/list.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { S3StorageDriver } from '../../../../lib/s3-driver'
 
 export const metadata = {
@@ -71,29 +72,30 @@ function resolveTenantScopedPrefix(prefix: string, tenantId: string, orgId: stri
 }
 
 export async function GET(req: Request) {
+  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
 
   const params = Object.fromEntries(new URL(req.url).searchParams.entries())
   const parsed = querySchema.safeParse(params)
   if (!parsed.success) {
-    return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.invalidQuery', 'Invalid query parameters') }, { status: 400 })
   }
 
   // Always scope list operations to the tenant namespace to prevent cross-tenant enumeration.
   const effectivePrefix = resolveTenantScopedPrefix(parsed.data.prefix, auth.tenantId, auth.orgId)
   if (effectivePrefix === null) {
     return NextResponse.json(
-      { error: 'Access denied: prefix is not scoped to this tenant.' },
+      { error: t('storage_s3.errors.prefixAccessDenied', 'Access denied: prefix is not scoped to this tenant.') },
       { status: 403 },
     )
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
   }
 
   const result = await driver.listObjects(

package/src/modules/storage_s3/api/post/storage-providers/s3/signed-url.ts

@@ -3,8 +3,13 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { isS3KeyAddressableByScope, isS3KeyScopedToTenant } from '../../../../lib/key-scope'
 import { S3StorageDriver } from '../../../../lib/s3-driver'
+import { createHash, randomBytes } from 'node:crypto'
+import { resolveAttachmentMaxBytes } from '@open-mercato/core/modules/attachments/lib/upload-limits'
+import type { AttachmentQuotaService } from '@open-mercato/core/modules/attachments/lib/quota-service'
+import { reconcileTenantS3Objects } from '../../../../lib/quota-accounting'
 
 export const metadata = {
   path: '/storage-providers/s3/signed-url',
@@ -16,11 +21,13 @@ const requestSchema = z.object({
   operation: z.enum(['upload', 'download']),
   expiresIn: z.number().int().min(60).max(604800).optional().default(3600),
   contentType: z.string().optional(),
+  size: z.number().int().nonnegative().optional(),
 })
 
 const responseSchema = z.object({
   url: z.string(),
   expiresAt: z.string(),
+  reservationId: z.string().optional(),
 })
 
 async function resolveDriver(tenantId: string, orgId: string): Promise<S3StorageDriver | null> {
@@ -34,33 +41,97 @@ async function resolveDriver(tenantId: string, orgId: string): Promise<S3Storage
 }
 
 export async function POST(req: Request) {
+  const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId || !auth.orgId) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    return NextResponse.json({ error: t('storage_s3.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
 
   const json = await req.json().catch(() => null)
   const parsed = requestSchema.safeParse(json)
   if (!parsed.success) {
-    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.invalidPayload', 'Invalid payload') }, { status: 400 })
   }
 
-  const { key, operation, expiresIn, contentType } = parsed.data
+  const { key, operation, expiresIn, contentType, size } = parsed.data
   const canAccessKey = operation === 'download'
     ? isS3KeyAddressableByScope(key, auth.orgId, auth.tenantId)
     : isS3KeyScopedToTenant(key, auth.orgId, auth.tenantId)
   if (!canAccessKey) {
-    return NextResponse.json({ error: 'Access denied: key is not scoped to this tenant.' }, { status: 403 })
+    return NextResponse.json({ error: t('storage_s3.errors.keyAccessDenied', 'Access denied: key is not scoped to this tenant.') }, { status: 403 })
   }
 
   const driver = await resolveDriver(auth.tenantId, auth.orgId)
   if (!driver) {
-    return NextResponse.json({ error: 'S3 integration is not configured.' }, { status: 400 })
+    return NextResponse.json({ error: t('storage_s3.errors.integrationNotConfigured', 'S3 integration is not configured.') }, { status: 400 })
   }
 
-  const url = await driver.getSignedUrl(key, operation, expiresIn, contentType)
   const expiresAt = new Date(Date.now() + expiresIn * 1000).toISOString()
 
+  if (operation === 'upload') {
+    const { resolve } = await createRequestContainer()
+    let attachmentQuotaService: AttachmentQuotaService | null = null
+    let recoveryScheduler: ((
+      payload: { reservationId: string; tenantId: string; organizationId: string },
+      delayMs: number,
+    ) => Promise<void>) | null = null
+    try {
+      attachmentQuotaService = resolve('attachmentQuotaService') as AttachmentQuotaService
+      recoveryScheduler = resolve('storageS3QuotaRecoveryScheduler') as (
+        payload: { reservationId: string; tenantId: string; organizationId: string },
+        delayMs: number,
+      ) => Promise<void>
+    } catch {
+      // Fail closed below when the attachments quota service is not registered.
+    }
+    if (!attachmentQuotaService) {
+      return NextResponse.json({ error: 'Storage quota accounting is unavailable.' }, { status: 500 })
+    }
+    const compatibilityToken = randomBytes(32).toString('base64url')
+    const reservedBytes = size ?? resolveAttachmentMaxBytes()
+    let reservation: Awaited<ReturnType<AttachmentQuotaService['reserve']>> | null = null
+    try {
+      await reconcileTenantS3Objects({
+        driver,
+        quotaService: attachmentQuotaService,
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+      })
+      reservation = await attachmentQuotaService.reserve({
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+        bytes: reservedBytes,
+        source: 'storage_s3_signed',
+        storageDriver: 's3',
+        storagePath: key,
+        uploadTokenHash: createHash('sha256').update(compatibilityToken).digest('hex'),
+        ttlMs: expiresIn * 1000,
+      })
+      if (!recoveryScheduler) throw new Error('Storage quota recovery is unavailable.')
+      await recoveryScheduler({
+        reservationId: reservation.id,
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))
+      const url = new URL(`/api/storage-providers/s3/signed-upload/${compatibilityToken}`, req.url).toString()
+      return NextResponse.json({ url, expiresAt, reservationId: reservation.id })
+    } catch (error) {
+      if (reservation) {
+        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => {})
+      }
+      const code = (error as { code?: unknown })?.code
+      if (code === 'quota_exceeded') {
+        return NextResponse.json({ error: 'Attachment storage quota exceeded for this tenant.' }, { status: 413 })
+      }
+      if (code === 'quota_target_exists') {
+        return NextResponse.json({ error: 'The target storage key already exists.' }, { status: 409 })
+      }
+      return NextResponse.json({ error: 'Storage quota accounting is unavailable.' }, { status: 500 })
+    }
+  }
+
+  const url = await driver.getSignedUrl(key, operation, expiresIn, contentType)
+
   return NextResponse.json({ url, expiresAt })
 }