PBVex file and image storage

Store only the opaque StorageId in a PBVex document. Original bytes and generated thumbnails live in PocketBase's configured local or S3-compatible object storage; SQLite holds the ID, object key, status, policy, and metadata. Before upload, authorize the caller against the intended parent/resource; after attachment, authorize through the owning document before returning metadata/URLs or deleting.

A canonical StorageId and successful v.image() value validation prove only storage-ID syntax under a valid image policy descriptor. They do not prove that an object exists, contains image bytes, was uploaded through that policy, belongs to the caller/document, or may be published.

Upload files and images

Generic files use ctx.storage.generateUploadUrl(). Images use a top-level schema field and a policy-bound URL:

image: v.image({
  thumbs: ['320x240f', '1600x0'],
  mimeTypes: ['image/jpeg', 'image/png', 'image/webp'],
});