File Uploads & Media Processing

const multer = require('multer');
const upload = multer({ dest: 'uploads/' });

app.post('/upload', upload.single('avatar'), (req, res) => {
  console.log(req.file); // { filename, path, size, mimetype, ... }
  res.json({ success: true });
});

Common follow-ups: Why can't express.json() parse a multipart/form-data request the way it parses a JSON body?;What's the difference between multer's disk storage and memory storage engines?

const upload = multer({
  limits: { fileSize: 5 * 1024 * 1024 }, // 5MB max
  fileFilter: (req, file, cb) => {
    const allowedTypes = ['image/jpeg', 'image/png'];
    if (!allowedTypes.includes(file.mimetype)) return cb(new Error('Invalid file type'));
    cb(null, true);
  },
});

Common follow-ups: Why is relying solely on the client-reported MIME type insufficient for genuinely verifying a file's actual content type?;How would you additionally verify a file's real type by inspecting its actual binary content (magic bytes) rather than trusting the reported MIME type?

const sharp = require('sharp');

await sharp(uploadedFilePath)
  .resize(800, 600, { fit: 'inside' })
  .jpeg({ quality: 80 })
  .toFile('resized-output.jpg');

Common follow-ups: How does sharp's performance and memory usage compare to a pure-JavaScript library like Jimp for the same resizing operation?;What image formats and operations does sharp support beyond basic resizing, like format conversion or watermarking?

const { S3Client, PutObjectCommand } = require('@aws-sdk/client-s3');
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');

app.post('/upload-url', async (req, res) => {
  const command = new PutObjectCommand({ Bucket: 'my-bucket', Key: `uploads/${crypto.randomUUID()}` });
  const url = await getSignedUrl(s3Client, command, { expiresIn: 300 });
  res.json({ uploadUrl: url });
});

Common follow-ups: How does this pre-signed URL approach limit what the client is allowed to do (like restricting the file size or content type) despite the server never seeing the actual upload?;What's the tradeoff of this approach in terms of being able to validate or process the file before it's stored?

const busboy = require('busboy');

app.post('/upload', (req, res) => {
  const bb = busboy({ headers: req.headers });
  bb.on('file', (name, fileStream) => {
    fileStream.pipe(s3UploadStream); // streams directly through to S3, no local disk write
  });
  req.pipe(bb);
});

Common follow-ups: What's the tradeoff of this streaming approach if a processing step later in the pipeline needs to seek backward within the file, which streams don't naturally support?;How would you handle validating a file's type before processing begins, given you only have the first chunk of a stream to inspect initially?

// Disk storage: writes to disk, file path available
const upload = multer({ storage: multer.diskStorage({ destination: 'uploads/' }) });

// Memory storage: buffer available directly, no disk write
const upload = multer({ storage: multer.memoryStorage() });
app.post('/upload', upload.single('file'), (req, res) => {
  s3.putObject({ Body: req.file.buffer, Key: req.file.originalname });
});

Common follow-ups: What's the memory risk of using memoryStorage for an endpoint that might receive very large files?;How would you clean up temporary files left on disk by diskStorage after they've been processed?

const ffmpeg = require('fluent-ffmpeg');

ffmpeg('input-video.mp4')
  .screenshots({
    timestamps: ['00:00:05'],
    filename: 'thumbnail.png',
    folder: './thumbnails',
  })
  .on('end', () => console.log('Thumbnail generated'));

Common follow-ups: Since ffmpeg processing is CPU-intensive, should this work run on the main Node.js process or be offloaded elsewhere?;What's the licensing consideration of bundling ffmpeg with a commercial application?

app.post('/upload', upload.single('video'), async (req, res) => {
  const jobId = await videoProcessingQueue.add('transcode', { filePath: req.file.path });
  res.status(202).json({ jobId, status: 'processing' });
});

Common follow-ups: How would sharp's or ffmpeg's own internal use of native threads change this calculus somewhat?;How does the client find out when the background processing job has completed?

const sharp = require('sharp');

const metadata = await sharp(req.file.path).metadata();
if (metadata.width < 200 || metadata.height < 200) {
  await fs.promises.unlink(req.file.path); // clean up the rejected upload
  return res.status(400).json({ error: 'Image must be at least 200x200 pixels' });
}

Common follow-ups: Why is checking actual image dimensions via a library more reliable than trying to infer size from file size alone?;What's an appropriate cleanup strategy for uploaded files that fail validation, to avoid accumulating orphaned files over time?

const crypto = require('node:crypto');
const path = require('node:path');

const safeExtension = path.extname(req.file.originalname).toLowerCase();
const allowedExtensions = ['.jpg', '.png', '.gif'];
if (!allowedExtensions.includes(safeExtension)) throw new Error('Invalid file extension');

const safeFilename = `${crypto.randomUUID()}${safeExtension}`; // never uses the raw client filename

Common follow-ups: What specific path-traversal payload would exploit an endpoint that uses the raw client filename directly?;Why is validating the extension against an allow-list safer than checking it against a deny-list of dangerous extensions?