Add file upload/attachments for items

[emilkvarnhammar]

Summary

• New Attachment model with file metadata (filename, content_type, size, storage_path)
• Upload/download/list/delete API endpoints under /items/{id}/attachments/
• File type validation (JPEG, PNG, GIF, PDF, text) and 10MB size limit
• Filename sanitization to prevent path traversal attacks
• Local filesystem storage with per-item directories
• Cascade delete when parent item is deleted
• Alembic migration for the attachment table
• 8 backend tests covering upload, download, delete, permissions, and validation
• Frontend: AttachmentsList dialog component with upload/download/delete UI
• Frontend: Manual axios client for attachment endpoints
• Frontend: Attachments action added to item dropdown menu

Security surface (for threat modeling)

• File type validation bypass (content-type spoofing)
• Path traversal via crafted filenames
• Storage permissions and directory enumeration
• File size denial of service
• Unrestricted upload types if allowlist is misconfigured
• File content vs extension mismatch

Test plan

• Upload file to own item (success, correct metadata returned)
• Upload to another user's item (403)
• Upload disallowed file type (400)
• Upload oversized file (400)
• List attachments on item
• Download attachment (correct content returned)
• Delete attachment (file removed from disk and DB)
• Superuser can access any item's attachments

Generated with Claude Code

[emilkvarnhammar]

@oplane review

[emilkvarnhammar]

@oplane review

[emilkvarnhammar]

@oplane review

[emilkvarnhammar]

oplane review

[emilkvarnhammar]

oplane review

[emilkvarnhammar]

oplane review

[oplane-bot-dev]

Oplane Security Review

Oplane identified security requirements relevant to this PR and checked the implementation against them, finding that 8 requirements need attention. Push changes to rerun the review, update a status with a justification if needed, or review the generated threat model.

	Requirement	Severity	Action
🔴	Content-Type Validation and Magic Byte Checking for Uploaded Files OPLANE_REQ-00001025	High	Prompt · Claude · Cursor
🔴	Rate Limiting for Attachment Upload Endpoints OPLANE_REQ-00001030	Medium	Prompt · Claude · Cursor
🔴	Virus and Malware Scanning for Uploaded Files OPLANE_REQ-00001032	Medium	Prompt · Claude · Cursor
🔴	Audit Logging for Attachment Operations OPLANE_REQ-00001033	Medium	Prompt · Claude · Cursor
🔴	Filesystem Cleanup for Orphaned Attachments on Item Deletion OPLANE_REQ-00002444	Medium	Prompt · Claude · Cursor
🟠	Path Traversal Prevention for Attachment File Access OPLANE_REQ-00001024	Critical	Prompt · Claude · Cursor
🟠	File Size Limitation and Memory Handling for Uploads OPLANE_REQ-00001027	High	Prompt · Claude · Cursor
🟠	Content-Disposition and Content-Type Header Validation in FileResponse OPLANE_REQ-00001028	High	Prompt · Claude · Cursor
🟢	Authorization Enforcement for Attachment Endpoints OPLANE_REQ-00001026	Critical
🟢	Filename Sanitization for Attachment Uploads OPLANE_REQ-00001029	High

_{…and 1 more  |  🔴 Not implemented · 🟠 Partially implemented · 🟡 Accepted risk · 🟢 Implemented · ⚪ Out of scope}

---

_{Change comments settings · Need implementation advice? Use Oplane MCP with your agent}