aim-attachment-domain

Securely managing message attachment uploads and downloads across internal gRPC services requires implementing an AttachmentService domain that handles authorization, object storage signing, and metadata persistence. It validates references and enforces strict boundary rules.

Generating pre-signed S3 requests for SeaweedFS with tracing context involves creating context-aware object storage requests within the attachment domain. This ensures upload operations carry observability data for debugging while maintaining strict authorization boundaries across internal services.

IM attachment media processing differs from ordinary file uploads because media attachments (image/video/audio) trigger an `aim.attachment.uploaded` event containing a file_id for downstream data parsing, while ordinary files are marked parsed immediately and skip parsing entirely.

Attachment metadata and object storage validations are persisted in PostgreSQL by writing metadata records after validating stored objects against context-aware signed requests. This ensures only authorized and correctly stored attachments have persisted reference data available for gateway validation.

Internal gateway attachment calls fail with incorrect error mapping when the gRPC domain does not use errorx codes for boundary violations. Correct attachment domain implementation requires mapping storage and authorization failures to specific errorx codes for consistent gateway handling.