Documentation Index
Fetch the complete documentation index at: https://docs-terra.withunify.org/llms.txt
Use this file to discover all available pages before exploring further.
File Storage
All files are stored in private Supabase Storage buckets. Zero public URLs.
Security Model
Government applicants upload sensitive documents: IDs, tax returns, medical records. These must never be publicly accessible.
Storage Structure
Files are stored with unpredictable paths:
form-uploads/
{formId}/
{uuid}/
{sanitized-filename}
The UUID prevents path enumeration attacks.
Upload Flow
// 1. Request signed upload URL
const { data } = await supabaseAdmin.storage
.from("form-uploads")
.createSignedUploadUrl(path);
// 2. Client uploads directly to signed URL
await fetch(data.signedUrl, {
method: "PUT",
body: file,
});
Download Flow (Admin Only)
// Generate short-lived download URL
const { data } = await supabaseAdmin.storage
.from("form-uploads")
.createSignedUrl(path, 60); // 60 second expiry
return data.signedUrl;
Google Drive Integration
For forms with Google Drive configured, files go to Drive instead:
if (form.google_drive_folder_id) {
// Upload to Drive via service account
const fileId = await uploadToDrive(file, folderId);
return { provider: "drive", fileId };
} else {
// Upload to Supabase
await uploadToSupabase(file, path);
return { provider: "supabase", path };
}
Google Drive
Drive integration setup