@open-mercato/sync-akeneo 0.9.1-develop.7553.1.8dbab05b5a → 0.9.1-develop.7567.1.b5e80ff620

package/src/modules/sync_akeneo/__tests__/client.response-limits.test.ts

@@ -0,0 +1,339 @@
+import { createAkeneoClient, type AkeneoClientDeps } from '../lib/client'
+
+const validCredentials = {
+  apiUrl: 'https://tenant.cloud.akeneo.com',
+  clientId: 'client-id',
+  clientSecret: 'client-secret',
+  username: 'api-user',
+  password: 'api-password',
+}
+
+const publicAkeneoLookupHost: AkeneoClientDeps['lookupHost'] = async () => [{ address: '93.184.216.34', family: 4 }]
+
+const MIB = 1024 * 1024
+const DEFAULT_MEDIA_MAX_BYTES = 25 * MIB
+const OVERSIZED_MEDIA_BYTES = 26 * MIB
+const STREAMED_OVERSIZED_MEDIA_BYTES = 40 * MIB
+const DOWNLOAD_PATH = '/api/rest/v1/media-files/asset-1/download'
+const DOWNLOAD_URL = `https://tenant.cloud.akeneo.com${DOWNLOAD_PATH}`
+const TOKEN_PATH = '/api/oauth/v1/token'
+const PRODUCTS_PATH = '/api/rest/v1/products-uuid'
+const ENV_KEYS = [
+  'OM_INTEGRATION_AKENEO_REQUEST_TIMEOUT_MS',
+  'OM_INTEGRATION_AKENEO_MAX_RESPONSE_BYTES',
+  'OM_ATTACHMENT_MAX_UPLOAD_MB',
+] as const
+
+function jsonResponse(body: unknown, init: ResponseInit = {}): Response {
+  return new Response(JSON.stringify(body), {
+    status: 200,
+    ...init,
+    headers: { 'content-type': 'application/json', ...(init.headers ?? {}) },
+  })
+}
+
+function tokenResponse(): Response {
+  return jsonResponse({ access_token: 'token-123', expires_in: 3600 })
+}
+
+function meteredBody(totalBytes: number, chunkBytes = MIB, fill = 0) {
+  const meter = { pulledBytes: 0, cancelled: false }
+  const stream = new ReadableStream<Uint8Array>({
+    pull(controller) {
+      if (meter.pulledBytes >= totalBytes) {
+        controller.close()
+        return
+      }
+      const size = Math.min(chunkBytes, totalBytes - meter.pulledBytes)
+      meter.pulledBytes += size
+      controller.enqueue(new Uint8Array(size).fill(fill))
+    },
+    cancel() {
+      meter.cancelled = true
+    },
+  }, { highWaterMark: 0 })
+  return { stream, meter }
+}
+
+function stalledBody(prefix: Uint8Array = new Uint8Array(16)) {
+  return new ReadableStream<Uint8Array>({
+    start(controller) {
+      controller.enqueue(prefix)
+    },
+    pull() {
+      return new Promise<void>(() => undefined)
+    },
+  }, { highWaterMark: 0 })
+}
+
+function jsonPayloadOfSize(totalBytes: number): string {
+  const skeleton = JSON.stringify({ items_count: 0, padding: '' })
+  return JSON.stringify({ items_count: 0, padding: 'x'.repeat(totalBytes - skeleton.length) })
+}
+
+function createClientServing(routes: Record<string, () => Response>) {
+  const fetchMock = jest.fn(async (input: RequestInfo | URL) => {
+    const url = new URL(String(input))
+    if (url.pathname === TOKEN_PATH && !routes[TOKEN_PATH]) return tokenResponse()
+    const route = routes[url.pathname]
+    if (route) return route()
+    return new Response('unexpected', { status: 500 })
+  })
+  const client = createAkeneoClient(validCredentials, {
+    lookupHost: publicAkeneoLookupHost,
+    fetchImpl: fetchMock as unknown as typeof fetch,
+  })
+  return { client, fetchMock }
+}
+
+async function settleWithin<T>(promise: Promise<T>, ms: number): Promise<'resolved' | 'timed-out' | 'rejected' | 'still-reading'> {
+  return Promise.race([
+    promise.then(
+      () => 'resolved' as const,
+      (error: unknown) => (error instanceof Error && error.name === 'FetchTimeoutError' ? 'timed-out' as const : 'rejected' as const),
+    ),
+    new Promise<'still-reading'>((resolve) => setTimeout(() => resolve('still-reading'), ms).unref()),
+  ])
+}
+
+describe('akeneo client response limits (issues #7233, #7242)', () => {
+  const originalEnv = Object.fromEntries(ENV_KEYS.map((key) => [key, process.env[key]]))
+
+  afterEach(() => {
+    for (const key of ENV_KEYS) {
+      const value = originalEnv[key]
+      if (value === undefined) delete process.env[key]
+      else process.env[key] = value
+    }
+  })
+
+  describe('media downloads (#7233)', () => {
+    it('accepts a chunked media body below the cap and reports its real byte length', async () => {
+      const { stream } = meteredBody(3 * MIB)
+      const { client } = createClientServing({
+        [DOWNLOAD_PATH]: () => new Response(stream, { status: 200, headers: { 'content-type': 'image/png' } }),
+      })
+
+      const binary = await client.downloadMediaFile(DOWNLOAD_URL)
+
+      expect(binary.buffer.byteLength).toBe(3 * MIB)
+      expect(binary.contentLength).toBe(3 * MIB)
+      expect(binary.contentType).toBe('image/png')
+    })
+
+    it('accepts a media body of exactly the attachment upload limit', async () => {
+      const { stream } = meteredBody(DEFAULT_MEDIA_MAX_BYTES)
+      const { client } = createClientServing({
+        [DOWNLOAD_PATH]: () => new Response(stream, { status: 200, headers: { 'content-type': 'image/png' } }),
+      })
+
+      const binary = await client.downloadMediaFile(DOWNLOAD_URL)
+
+      expect(binary.buffer.byteLength).toBe(DEFAULT_MEDIA_MAX_BYTES)
+    })
+
+    it('aborts a chunked media body without Content-Length once it passes the cap, without buffering the rest', async () => {
+      const { stream, meter } = meteredBody(STREAMED_OVERSIZED_MEDIA_BYTES)
+      const { client } = createClientServing({
+        [DOWNLOAD_PATH]: () => new Response(stream, { status: 200, headers: { 'content-type': 'image/png' } }),
+      })
+
+      await expect(client.downloadMediaFile(DOWNLOAD_URL)).rejects.toMatchObject({
+        name: 'AkeneoResponseTooLargeError',
+        limitBytes: DEFAULT_MEDIA_MAX_BYTES,
+      })
+
+      expect(meter.pulledBytes).toBeLessThanOrEqual(DEFAULT_MEDIA_MAX_BYTES + MIB)
+      expect(meter.pulledBytes).toBeLessThan(STREAMED_OVERSIZED_MEDIA_BYTES)
+      expect(meter.cancelled).toBe(true)
+    })
+
+    it('rejects a declared Content-Length above the cap before reading the body', async () => {
+      const { stream, meter } = meteredBody(OVERSIZED_MEDIA_BYTES)
+      const { client } = createClientServing({
+        [DOWNLOAD_PATH]: () => new Response(stream, {
+          status: 200,
+          headers: { 'content-type': 'image/png', 'content-length': String(OVERSIZED_MEDIA_BYTES) },
+        }),
+      })
+
+      await expect(client.downloadMediaFile(DOWNLOAD_URL)).rejects.toMatchObject({ name: 'AkeneoResponseTooLargeError' })
+
+      expect(meter.pulledBytes).toBeLessThanOrEqual(MIB)
+    })
+
+    it('follows OM_ATTACHMENT_MAX_UPLOAD_MB for the media cap', async () => {
+      process.env.OM_ATTACHMENT_MAX_UPLOAD_MB = '1'
+      const { stream, meter } = meteredBody(3 * MIB, 256 * 1024)
+      const { client } = createClientServing({
+        [DOWNLOAD_PATH]: () => new Response(stream, { status: 200, headers: { 'content-type': 'image/png' } }),
+      })
+
+      await expect(client.downloadMediaFile(DOWNLOAD_URL)).rejects.toMatchObject({ limitBytes: MIB })
+
+      expect(meter.pulledBytes).toBeLessThanOrEqual(MIB + 256 * 1024)
+    })
+
+    it('reports the bytes actually received, not a misleading Content-Length header', async () => {
+      const { client } = createClientServing({
+        [DOWNLOAD_PATH]: () => new Response(new Uint8Array(5), {
+          status: 200,
+          headers: { 'content-type': 'image/png', 'content-length': '1' },
+        }),
+      })
+
+      const binary = await client.downloadMediaFile(DOWNLOAD_URL)
+
+      expect(binary.buffer.byteLength).toBe(5)
+      expect(binary.contentLength).toBe(5)
+    })
+
+    it('keeps the request deadline running while the media body is consumed', async () => {
+      process.env.OM_INTEGRATION_AKENEO_REQUEST_TIMEOUT_MS = '100'
+      const { client } = createClientServing({
+        [DOWNLOAD_PATH]: () => new Response(stalledBody(), { status: 200, headers: { 'content-type': 'image/png' } }),
+      })
+
+      await expect(settleWithin(client.downloadMediaFile(DOWNLOAD_URL), 1_500)).resolves.toBe('timed-out')
+    })
+  })
+
+  describe('JSON and error bodies (#7242)', () => {
+    it('reads an ordinary multi-page product listing', async () => {
+      const { client, fetchMock } = createClientServing({
+        [PRODUCTS_PATH]: () => {
+          const pageCalls = fetchMock.mock.calls.filter(([input]) => new URL(String(input)).pathname === PRODUCTS_PATH)
+          const isSecondPage = new URL(String(pageCalls[pageCalls.length - 1]?.[0])).searchParams.get('page') === '2'
+          return jsonResponse({
+            _embedded: { items: [{ uuid: isSecondPage ? 'uuid-2' : 'uuid-1' }] },
+            _links: isSecondPage ? {} : { next: { href: `https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2` } },
+          })
+        },
+      })
+
+      const first = await client.listProducts({ batchSize: 1 })
+      const second = await client.listProducts({ batchSize: 1, nextUrl: first.nextUrl })
+
+      expect(first.items.map((item) => item.uuid)).toEqual(['uuid-1'])
+      expect(first.nextUrl).toBe(`https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2`)
+      expect(second.items.map((item) => item.uuid)).toEqual(['uuid-2'])
+      expect(second.nextUrl).toBeNull()
+    })
+
+    it('accepts a JSON body of exactly the configured response limit', async () => {
+      process.env.OM_INTEGRATION_AKENEO_MAX_RESPONSE_BYTES = String(64 * 1024)
+      const payload = jsonPayloadOfSize(64 * 1024)
+      const { client } = createClientServing({
+        '/api/rest/v1/system-information': () => new Response(payload, { status: 200, headers: { 'content-type': 'application/json' } }),
+      })
+
+      expect(Buffer.byteLength(payload)).toBe(64 * 1024)
+      await expect(client.getSystemProbe()).resolves.toEqual({ version: null })
+    })
+
+    it('aborts a chunked JSON body without Content-Length once it passes the configured limit', async () => {
+      process.env.OM_INTEGRATION_AKENEO_MAX_RESPONSE_BYTES = String(MIB)
+      const { stream, meter } = meteredBody(8 * MIB, 256 * 1024, 0x20)
+      const { client } = createClientServing({
+        [PRODUCTS_PATH]: () => new Response(stream, { status: 200, headers: { 'content-type': 'application/json' } }),
+      })
+
+      await expect(client.listProducts({ batchSize: 10, nextUrl: `https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2` }))
+        .rejects.toMatchObject({ name: 'AkeneoResponseTooLargeError', limitBytes: MIB })
+
+      expect(meter.pulledBytes).toBeLessThanOrEqual(MIB + 256 * 1024)
+      expect(meter.cancelled).toBe(true)
+    })
+
+    it('rejects a JSON body whose declared Content-Length is above the limit before reading it', async () => {
+      process.env.OM_INTEGRATION_AKENEO_MAX_RESPONSE_BYTES = String(MIB)
+      const { stream, meter } = meteredBody(8 * MIB, 256 * 1024, 0x20)
+      const { client } = createClientServing({
+        [PRODUCTS_PATH]: () => new Response(stream, {
+          status: 200,
+          headers: { 'content-type': 'application/json', 'content-length': String(8 * MIB) },
+        }),
+      })
+
+      await expect(client.listProducts({ batchSize: 10, nextUrl: `https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2` }))
+        .rejects.toMatchObject({ name: 'AkeneoResponseTooLargeError' })
+
+      expect(meter.pulledBytes).toBe(0)
+    })
+
+    it('bounds the OAuth token response body', async () => {
+      process.env.OM_INTEGRATION_AKENEO_MAX_RESPONSE_BYTES = String(MIB)
+      const { stream, meter } = meteredBody(8 * MIB, 256 * 1024, 0x20)
+      const { client } = createClientServing({
+        [TOKEN_PATH]: () => new Response(stream, { status: 200, headers: { 'content-type': 'application/json' } }),
+      })
+
+      await expect(client.listProducts({ batchSize: 10, nextUrl: `https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2` }))
+        .rejects.toMatchObject({ name: 'AkeneoResponseTooLargeError' })
+
+      expect(meter.pulledBytes).toBeLessThanOrEqual(MIB + 256 * 1024)
+    })
+
+    it('keeps the request deadline running while a JSON page drips', async () => {
+      process.env.OM_INTEGRATION_AKENEO_REQUEST_TIMEOUT_MS = '100'
+      const { client } = createClientServing({
+        [PRODUCTS_PATH]: () => new Response(stalledBody(new TextEncoder().encode('{"_embedded":{"items":[')), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+      })
+
+      const outcome = await settleWithin(
+        client.listProducts({ batchSize: 10, nextUrl: `https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2` }),
+        1_500,
+      )
+
+      expect(outcome).toBe('timed-out')
+    })
+
+    it('keeps the request deadline running while the OAuth token body drips', async () => {
+      process.env.OM_INTEGRATION_AKENEO_REQUEST_TIMEOUT_MS = '100'
+      const { client } = createClientServing({
+        [TOKEN_PATH]: () => new Response(stalledBody(new TextEncoder().encode('{"access_token":')), {
+          status: 200,
+          headers: { 'content-type': 'application/json' },
+        }),
+      })
+
+      const outcome = await settleWithin(
+        client.listProducts({ batchSize: 10, nextUrl: `https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2` }),
+        1_500,
+      )
+
+      expect(outcome).toBe('timed-out')
+    })
+
+    it('truncates a huge error body instead of buffering all of it', async () => {
+      const { stream, meter } = meteredBody(8 * MIB, 256 * 1024, 0x61)
+      const { client } = createClientServing({
+        [PRODUCTS_PATH]: () => new Response(stream, { status: 500, headers: { 'content-type': 'text/plain' } }),
+      })
+
+      const error = await client.listProducts({
+        batchSize: 10,
+        nextUrl: `https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2`,
+      }).catch((err: unknown) => err as Error)
+
+      expect(error).toBeInstanceOf(Error)
+      expect(error.message.startsWith('Akeneo request failed (500): aaaa')).toBe(true)
+      expect(error.message.length).toBeLessThanOrEqual(64 * 1024 + 64)
+      expect(meter.pulledBytes).toBeLessThanOrEqual(64 * 1024 + 256 * 1024)
+    })
+
+    it('keeps short error bodies intact in the thrown message', async () => {
+      const { client } = createClientServing({
+        [PRODUCTS_PATH]: () => new Response('{"message":"Forbidden"}', { status: 403 }),
+      })
+
+      await expect(client.listProducts({
+        batchSize: 10,
+        nextUrl: `https://tenant.cloud.akeneo.com${PRODUCTS_PATH}?page=2`,
+      })).rejects.toThrow('Akeneo request failed (403): {"message":"Forbidden"}')
+    })
+  })
+})

package/src/modules/sync_akeneo/i18n/de.json

@@ -52,6 +52,7 @@
   "sync_akeneo.discovery.locales": "Sprachen",
   "sync_akeneo.discovery.priceKinds": "Katalogpreisarten",
   "sync_akeneo.discovery.rediscovered": "Akeneo-Felder aktualisiert und fehlende Zuordnungen hinzugefügt.",
+  "sync_akeneo.errors.mediaStorageRejected": "Akeneo-Medium {code} wurde vom Anhangsspeicher abgelehnt ({reason}).",
   "sync_akeneo.feature.configure": "Akeneo-Synchronisierungseinstellungen konfigurieren",
   "sync_akeneo.feature.view": "Akeneo-Synchronisierungskonfiguration anzeigen",
   "sync_akeneo.firstImport.action": "Ersten vollständigen Import starten",

package/src/modules/sync_akeneo/i18n/en.json

@@ -52,6 +52,7 @@
   "sync_akeneo.discovery.locales": "Locales",
   "sync_akeneo.discovery.priceKinds": "Catalog price kinds",
   "sync_akeneo.discovery.rediscovered": "Akeneo fields refreshed and missing mappings added.",
+  "sync_akeneo.errors.mediaStorageRejected": "Akeneo media {code} was rejected by attachment storage ({reason}).",
   "sync_akeneo.feature.configure": "Configure Akeneo sync settings",
   "sync_akeneo.feature.view": "View Akeneo sync configuration",
   "sync_akeneo.firstImport.action": "Run the first full import",

package/src/modules/sync_akeneo/i18n/es.json

@@ -52,6 +52,7 @@
   "sync_akeneo.discovery.locales": "Idiomas",
   "sync_akeneo.discovery.priceKinds": "Tipos de precios de catálogo",
   "sync_akeneo.discovery.rediscovered": "Campos Akeneo actualizados y asignaciones faltantes agregadas.",
+  "sync_akeneo.errors.mediaStorageRejected": "El almacenamiento de adjuntos rechazó el archivo multimedia de Akeneo {code} ({reason}).",
   "sync_akeneo.feature.configure": "Configurar ajustes de sincronización Akeneo",
   "sync_akeneo.feature.view": "Ver configuración de sincronización Akeneo",
   "sync_akeneo.firstImport.action": "Ejecutar la primera importación completa",

package/src/modules/sync_akeneo/i18n/ko.json

@@ -52,6 +52,7 @@
   "sync_akeneo.discovery.locales": "로케일",
   "sync_akeneo.discovery.priceKinds": "카탈로그 가격 종류",
   "sync_akeneo.discovery.rediscovered": "Akeneo 필드가 새로고침되고 누락된 매핑이 추가되었습니다.",
+  "sync_akeneo.errors.mediaStorageRejected": "첨부 파일 저장소가 Akeneo 미디어 {code}을(를) 거부했습니다({reason}).",
   "sync_akeneo.feature.configure": "Akeneo 동기화 설정 구성",
   "sync_akeneo.feature.view": "Akeneo 동기화 구성 보기",
   "sync_akeneo.firstImport.action": "첫 전체 가져오기 실행",

package/src/modules/sync_akeneo/i18n/pl.json

@@ -52,6 +52,7 @@
   "sync_akeneo.discovery.locales": "Lokalizacje",
   "sync_akeneo.discovery.priceKinds": "Rodzaje cen katalogowych",
   "sync_akeneo.discovery.rediscovered": "Pola Akeneo odświeżone i brakujące mapowania dodane.",
+  "sync_akeneo.errors.mediaStorageRejected": "Magazyn załączników odrzucił plik multimedialny Akeneo {code} ({reason}).",
   "sync_akeneo.feature.configure": "Konfiguracja ustawień synchronizacji Akeneo",
   "sync_akeneo.feature.view": "Podgląd konfiguracji synchronizacji Akeneo",
   "sync_akeneo.firstImport.action": "Uruchom pierwszy pełny import",

package/src/modules/sync_akeneo/lib/catalog-importer.ts

@@ -6,6 +6,8 @@ import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib
 import { emitCrudSideEffects, setCustomFieldsIfAny } from '@open-mercato/shared/lib/commands/helpers'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { DataMapping } from '@open-mercato/core/modules/data_sync/lib/adapter'
 import type { ExternalIdMappingService } from '@open-mercato/core/modules/data_sync/lib/id-mapping'
 import { SyncExternalIdMapping } from '@open-mercato/core/modules/integrations/data/entities'
@@ -25,9 +27,13 @@ import { normalizeEntityFieldsetConfig, type CustomFieldsetDefinition } from '@o
 import { invalidateDefinitionsCache } from '@open-mercato/core/modules/entities/api/definitions.cache'
 import { Attachment } from '@open-mercato/core/modules/attachments/data/entities'
 import { buildAttachmentFileUrl, buildAttachmentImageUrl, slugifyAttachmentFileName } from '@open-mercato/core/modules/attachments/lib/imageUrls'
-import { deletePartitionFile, storePartitionFile } from '@open-mercato/core/modules/attachments/lib/storage'
-import { ensureDefaultPartitions, resolveDefaultPartitionCode } from '@open-mercato/core/modules/attachments/lib/partitions'
-import { mergeAttachmentMetadata } from '@open-mercato/core/modules/attachments/lib/metadata'
+import type { AttachmentService } from '@open-mercato/core/modules/attachments'
+import {
+  isScopedAttachmentUploadError,
+  type ScopedAttachmentUploadErrorCode,
+  type ScopedAttachmentUploadService,
+} from '@open-mercato/core/modules/attachments/lib/scoped-upload-service'
+import type { IntegrationLogService } from '@open-mercato/core/modules/integrations/lib/log-service'
 import { attachmentCrudEvents, attachmentCrudIndexer } from '@open-mercato/core/modules/attachments/lib/crud'
 import { emitCatalogQueryIndexEvent } from '@open-mercato/core/modules/catalog/commands/shared'
 import { SalesChannel } from '@open-mercato/core/modules/sales/data/entities'
@@ -52,7 +58,7 @@ import {
   type AkeneoValues,
   buildDefaultAkeneoMapping,
 } from './shared'
-import type { AkeneoClient } from './client'
+import { isAkeneoResponseTooLargeError, type AkeneoClient } from './client'
 import { inferAkeneoProductMapping } from './inference'
 import { normalizeMarkdownText } from './markdown'
 
@@ -61,6 +67,12 @@ type ImportScope = {
   tenantId: string
 }
 
+const REJECTED_MEDIA_UPLOAD_CODES: ReadonlySet<ScopedAttachmentUploadErrorCode> = new Set([
+  'dangerous_executable',
+  'max_upload_size',
+  'active_content',
+])
+
 type UpsertResult = {
   localId: string
   action: 'create' | 'update' | 'skip'
@@ -2305,42 +2317,64 @@ export async function createAkeneoImporter(client: AkeneoClient, scope: ImportSc
     }
   }
 
-  async function upsertAsset(asset: DesiredAsset): Promise<string> {
+  async function recordRejectedMedia(asset: DesiredAsset, reason: string): Promise<void> {
+    const integrationLogService = container.resolve('integrationLogService') as IntegrationLogService
+    await integrationLogService.write({
+      integrationId: 'sync_akeneo',
+      level: 'warn',
+      code: 'sync_akeneo.media_rejected',
+      message: `Akeneo media ${asset.remote.codeOrUrl} was not imported: ${reason}`,
+      scopeEntityType: asset.entityId,
+      scopeEntityId: asset.recordId,
+      payload: {
+        externalId: asset.externalId,
+        remoteCode: asset.remote.codeOrUrl,
+        kind: asset.kind,
+        reason,
+      },
+    }, scope)
+  }
+
+  async function upsertAsset(asset: DesiredAsset): Promise<string | null> {
     const existingAttachmentId = await externalIdMappingService.lookupLocalId('sync_akeneo', 'attachment', asset.externalId, scope)
     if (existingAttachmentId) return existingAttachmentId
 
-    await ensureDefaultPartitions(em)
-    const binary = await client.downloadMediaFile(asset.remote.codeOrUrl)
+    let binary: Awaited<ReturnType<AkeneoClient['downloadMediaFile']>>
+    try {
+      binary = await client.downloadMediaFile(asset.remote.codeOrUrl)
+    } catch (error) {
+      if (!isAkeneoResponseTooLargeError(error)) throw error
+      await recordRejectedMedia(asset, 'max_upload_size')
+      return null
+    }
     const fileName = asset.remote.fileNameHint ?? binary.fileName ?? `akeneo-${randomUUID().slice(0, 8)}`
-    const partitionCode = resolveDefaultPartitionCode(asset.entityId)
-    const stored = await storePartitionFile({
-      partitionCode,
-      orgId: scope.organizationId,
-      tenantId: scope.tenantId,
-      fileName,
-      buffer: binary.buffer,
-    })
-    const attachment = em.create(Attachment, {
-      entityId: asset.entityId,
-      recordId: asset.recordId,
-      organizationId: scope.organizationId,
-      tenantId: scope.tenantId,
-      partitionCode,
-      fileName,
-      mimeType: asset.remote.mimeTypeHint ?? binary.contentType ?? 'application/octet-stream',
-      fileSize: binary.contentLength ?? binary.buffer.byteLength,
-      storageDriver: 'local',
-      storagePath: stored.storagePath,
-      storageMetadata: mergeAttachmentMetadata(null, {
-        assignments: [{ type: asset.entityId, id: asset.recordId }],
-      }),
-      url: buildAttachmentFileUrl('pending'),
-      content: null,
-    })
-    em.persist(attachment)
-    await em.flush()
+    const uploadService = container.resolve('attachmentScopedUploadService') as ScopedAttachmentUploadService
+    let attachment: Attachment
+    try {
+      attachment = await uploadService.upload({
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        entityId: asset.entityId,
+        recordId: asset.recordId,
+        fileName,
+        declaredMimeType: asset.remote.mimeTypeHint ?? binary.contentType,
+        buffer: binary.buffer,
+      })
+    } catch (error) {
+      if (!isScopedAttachmentUploadError(error)) throw error
+      if (REJECTED_MEDIA_UPLOAD_CODES.has(error.code)) {
+        await recordRejectedMedia(asset, error.code)
+        return null
+      }
+      const { translate } = await resolveTranslations()
+      throw new Error(translate(
+        'sync_akeneo.errors.mediaStorageRejected',
+        'Akeneo media {code} was rejected by attachment storage ({reason}).',
+        { code: asset.remote.codeOrUrl, reason: error.code },
+      ))
+    }
     attachment.url = asset.kind === 'image'
-      ? buildAttachmentImageUrl(attachment.id, { slug: slugifyAttachmentFileName(fileName) })
+      ? buildAttachmentImageUrl(attachment.id, { slug: slugifyAttachmentFileName(attachment.fileName) })
       : buildAttachmentFileUrl(attachment.id)
     attachment.storageMetadata = {
       ...(attachment.storageMetadata ?? {}),
@@ -2350,11 +2384,32 @@ export async function createAkeneoImporter(client: AkeneoClient, scope: ImportSc
       remoteCode: asset.remote.codeOrUrl,
     }
     await em.flush()
-    await emitAttachmentCrudChange('created', attachment)
+    await emitAttachmentCrudChange('updated', attachment)
     await externalIdMappingService.storeExternalIdMapping('sync_akeneo', 'attachment', attachment.id, asset.externalId, scope)
     return attachment.id
   }
 
+  async function releaseImportedAttachment(attachment: Attachment): Promise<boolean> {
+    const attachmentService = container.resolve('attachmentService') as AttachmentService
+    if (!attachmentService.releaseScoped) {
+      throw new Error('[internal] attachmentService.releaseScoped is not available')
+    }
+    try {
+      await attachmentService.releaseScoped({
+        attachmentId: attachment.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        expectedOwner: { entityId: attachment.entityId, recordId: attachment.recordId },
+        expectedAssignment: { type: attachment.entityId, id: attachment.recordId },
+        expectedPartitionCode: attachment.partitionCode,
+      })
+      return true
+    } catch (error) {
+      if (isCrudHttpError(error) && error.status === 409) return false
+      throw error
+    }
+  }
+
   async function reconcileAttachments(params: {
     entityId: string
     recordId: string
@@ -2362,12 +2417,11 @@ export async function createAkeneoImporter(client: AkeneoClient, scope: ImportSc
     reconciliation: AkeneoReconciliationSettings
   }): Promise<{ heroAttachmentId: string | null; heroAttachmentUrl: string | null }> {
     const desiredExternalIds = new Set(params.desiredAssets.map((asset) => asset.externalId))
-    const desiredImages = params.desiredAssets.filter((asset) => asset.kind === 'image')
-    const desiredFiles = params.desiredAssets.filter((asset) => asset.kind === 'file')
-    const desiredAttachmentIds = await Promise.all(params.desiredAssets.map((asset) => upsertAsset(asset)))
-    const heroAttachmentId = desiredImages.length > 0
-      ? desiredAttachmentIds[params.desiredAssets.findIndex((asset) => asset.externalId === desiredImages[0]?.externalId)]
-      : null
+    let heroAttachmentId: string | null = null
+    for (const asset of params.desiredAssets) {
+      const attachmentId = await upsertAsset(asset)
+      if (!heroAttachmentId && attachmentId && asset.kind === 'image') heroAttachmentId = attachmentId
+    }
     const heroAttachmentUrl = heroAttachmentId ? buildAttachmentImageUrl(heroAttachmentId) : null
 
     const existing = await findWithDecryption(em, Attachment, {
@@ -2385,8 +2439,7 @@ export async function createAkeneoImporter(client: AkeneoClient, scope: ImportSc
         ? params.reconciliation.deleteMissingMedia
         : params.reconciliation.deleteMissingAttachments
       if (!shouldDelete || desiredExternalIds.has(externalId)) continue
-      await deletePartitionFile(attachment.partitionCode, attachment.storagePath, attachment.storageDriver)
-      await em.remove(attachment).flush()
+      if (!(await releaseImportedAttachment(attachment))) continue
       await emitAttachmentCrudChange('deleted', attachment)
     }