Asset Management#

Storyden's asset system handles user-uploaded files across posts, library nodes, links, and branding. The core domain model, storage pipeline, and safety infrastructure are split across a few focused packages.

Core Domain Model#

The Asset struct holds an AssetID (an xid.ID), a Filename, byte Size, MIME type, free-form Metadata, and an optional Parent asset reference — enabling versioned or derived assets 1.

Metadata is a map[string]any 2 stored as a JSON column in the database 3. Typed accessor helpers GetWidth() and GetHeight() read image dimensions out of this map as float64, returning 0.0 when absent.

Filename is a value type (app/resources/asset/filename.go) that slugifies and prefixes names with an xid ID (e.g., <id>-<slug>). BuildAssetPath resolves a filename to its object-storage path under the assets/ subdirectory.

Database Schema#

The Ent schema (internal/ent/schema/asset.go) defines:

Assets are owned by an Account and relate to Post, Node, Link, and Event edges 8.

Upload Pipeline#

app/services/asset/asset_upload/uploader.go is the general-purpose upload entry point. On each call to Upload, it:

1. Reads the authenticated account from context 9
2. Detects the MIME type from the byte stream 10
3. Persists asset metadata to the database via asset_writer.Writer — calling Add for new assets or AddVersion when a ParentID is provided 11
4. Writes the raw bytes to object storage via object.Storer 12

Note that the general uploader does not perform image decoding or dimension extraction. Width/height metadata must be populated by the caller before or after the upload step if needed.

Branding Image Processing Pipeline#

Branding assets (site icons and OpenGraph banners) go through a dedicated resize pipeline before storage:

• Icon service (app/services/branding/icon/service.go): decodes the upload, then uses imaging.Resize to generate multiple icon sizes (512×512, 180×180, 167×167, 152×152, 120×120, 32×32) encoded as PNG 13.
• Banner service (app/services/branding/banner/opengraph.go): decodes the upload and resizes to 1200×630 (the standard OpenGraph dimension) 14.

Both services route the incoming reader through imagesafe.Decode before any resize operation.

Decompression Bomb Protection (imagesafe)#

internal/infrastructure/imagesafe/imagesafe.go is a safety wrapper around Go's standard image.Decode. Its Decode(r io.Reader) function:

1. Caps encoded input at maxEncodedBytes = 64 MiB using io.LimitReader before buffering 15
2. Reads only the image header with image.DecodeConfig via a TeeReader, avoiding full pixel allocation 16
3. Rejects dimension bombs: rejects non-positive dimensions and anything where Width × Height > MaxPixels (64 million pixels) 17
4. Only then reads the full encoded body and calls image.Decode 18

Errors exposed: ErrImageTooLarge and ErrEncodedTooLarge 19.

Why this matters: image formats (PNG, GIF) can compress large uniform images extremely well. A file of a few hundred KB with declared dimensions of 100000×100000 would allocate ~40 GB during decode. In Go, a failed allocation is fatal and takes down the whole process 20. This guard was added in PR #786 after the branding upload endpoints were found to decode user-supplied images without any dimension check.

Key Source Files#