File storage

Tier: on demand — applies the moment the application accepts a file. From then on, the public-versus-protected decision is core; Flysystem and object storage are the price of the suite's container deployment.

Where an uploaded file goes, how it comes back out, and what the database holds.

symfony-yoandev-http covers receiving the upload — #[MapUploadedFile], files inside a payload DTO, the constraints that run at the boundary. This skill starts one line later, at the point where a controller holds a valid UploadedFile and something has to decide what to do with it.

Start here: a file under public/ has no access control

// Every authorisation rule in the project is now irrelevant for this file.
$file->move($this->getParameter('kernel.project_dir').'/public/uploads', $file->getClientOriginalName());