Java 21 · Spring Boot
Working
Object-Storage File Upload and Download Service
Multipart upload and streamed download that never buffers a file in heap
Full REST contract implemented against MinIO with JWT-scoped routes
Overview
A file service over S3-compatible object storage: multipart upload, streamed download, paginated listing, metadata update and delete, behind a REST contract where every route is scoped to the caller identity taken from the JWT rather than from a request parameter.
The load-bearing detail is the download path. Reading an object into memory and returning a byte array works in testing and falls over on a large file under concurrency, because heap usage scales with file size times concurrent downloads. Streaming through InputStreamResource keeps memory flat regardless of object size. Buckets are auto-provisioned at startup, so the service deploys into an empty environment without a manual setup step.
Stack
- Language
- Java 21, Spring Boot
- Object storage
- MinIO, S3-compatible
- Metadata
- PostgreSQL
- Auth
- Bearer JWT, identity scoping per route
Decisions Worth Explaining
InputStreamResource instead of buffering in heap
Memory stays flat regardless of object size or concurrent download count. Returning a byte array couples heap to the largest file anyone uploads.
Identity from the JWT, never from a parameter
A caller-supplied owner id is an authorization bug waiting to be found. Deriving scope from the verified token makes the tenant boundary unforgeable.
Buckets auto-provisioned at startup
The service comes up in an empty environment with no operator runbook step, which matters for ephemeral test environments.
What Is Not Done
- No virus or content-type scanning on upload.
- No lifecycle or retention policy on stored objects.