Secure File Upload Architecture: Direct S3 Presigned URLs & Magic Number Validation

[ Client ] -- 50MB File --> [ App Server (Memory Spikes!) ] -- 50MB File --> [ S3 Bucket ]

1. Request Upload Ticket:
   [ Client ] --- POST /api/uploads/presign (filename, mime, size) ---> [ App Server ]
   [ Client ] <--- 200 OK (Presigned S3 URL + Token) ----------------- [ App Server ]

2. Direct Upload to Cloud:
   [ Client ] === Direct HTTP PUT (50MB Binary) ===> [ AWS S3 / Cloudflare R2 ]

3. Asynchronous Confirmation & Quarantine Scan:
   [ S3 Event / Webhook ] ---> [ Async Worker / Lambda (Magic Bytes & Antivirus Scan) ]

import { fileTypeFromBuffer } from 'file-type';

export async function validateImageHeader(buffer: Buffer): Promise<boolean> {
  const type = await fileTypeFromBuffer(buffer);
  if (!type) return false;

  const allowedMimeTypes = ['image/jpeg', 'image/png', 'image/webp'];
  return allowedMimeTypes.includes(type.mime);
}

import { S3Client, PutObjectCommand } from '@aws-sdk/client-s3';
import { getSignedUrl } from '@aws-sdk/s3-request-presigner';

@Injectable()
export class UploadService {
  private s3 = new S3Client({ region: process.env.AWS_REGION });

  async generatePresignedUpload(userId: string, filename: string, mimeType: string) {
    const key = `uploads/${userId}/${crypto.randomUUID()}-${filename}`;

    const command = new PutObjectCommand({
      Bucket: process.env.S3_BUCKET_NAME,
      Key: key,
      ContentType: mimeType,
    });

    const uploadUrl = await getSignedUrl(this.s3, command, { expiresIn: 300 }); // 5 minutes valid

    return { uploadUrl, fileKey: key };
  }
}