Ticket Attachments

Single-file multipart upload bound to a ticket. The storage backend is the chatmo-crm bucket provider (Backblaze B2 at time of writing — swappable via BUCKET_PROVIDER); the returned file_url is a direct, publicly-readable bucket URL.

Validation runs in three layers — size cap (10 MB), extension allowlist (.jpg .jpeg .png .gif .pdf .doc .docx .xls .xlsx .csv .txt), and magic-number signature check (catches renamed .exe → .png and Content-Type spoofing).

ZIP / RAR are intentionally not on the allowlist — zip-bombs and password-protected RARs hiding malware were the original reasons. The dashboard's permissive list is broader; the public mobile / integrator surface stays conservative.

Hard-deletes the attachment row. The storage blob is intentionally left in place — keeping orphans is cheaper than a flaky delete on the hot path, and a future GC sweep can reconcile by listing bucket objects against the table.

The attachment lookup is scoped to the parent ticket id — even within the same organization, calling DELETE with a (ticket, attachment) pair that does not actually belong together returns 404.