object-storage

File uploads to object storage in a pnpm monorepo are handled using presigned URLs, allowing a frontend client to upload assets directly to a GCS-backed bucket. This bypasses the backend server to reduce upload latency and server bandwidth consumption.

Serving public and private objects from GCS is managed through distinct Express routes that enforce ACL policies. This approach separates public asset delivery from private, restricted object serving while maintaining secure access control.

Presigned URLs enable direct browser uploads to cloud storage by providing a temporary, signed token for the frontend client. The backend generates this URL, granting the client time-limited permission to write files directly to the GCS bucket.

Storage security and ACL policies for user-uploaded web assets are enforced by the backend service that generates presigned URLs. This service applies access control rules before issuing upload tokens and serving endpoints via Express routes.

This object storage setup targets web stacks specifically using pnpm monorepos and Express routes. While the presigned URL mechanism is framework-agnostic, the provided client libraries and server routes are designed for this pnpm architecture.

Limitations of using presigned URLs for web app storage include the temporary nature of the upload tokens and the need for distinct Express routes to manage ACL policies for public versus private object serving.