waaseyaa/media

Media entity type and file management for Waaseyaa

Maintainers

Package info

github.com/waaseyaa/media

pkg:composer/waaseyaa/media

Transparency log

Statistics

Installs: 6 467

Dependents: 4

Suggesters: 0

Stars: 0

Open Issues: 0

Security

Advisories: 0

Aikido package health analysis

v0.1.0-alpha.256 2026-07-06 21:24 UTC

Requires

Requires (Dev)

GPL-2.0-or-later 7136eddbc9a6f00158724b48175ea0ac5417452f

Published on Packagist.org on 2026-07-06 21:32 UTC

This package is auto-updated.

Last update: 2026-07-06 21:32:26 UTC

README

Layer 2 — Content Types

Media entity type for Waaseyaa applications.

Defines the media entity type for images, documents, and other binary assets. Includes upload handling, file metadata storage, and access policy integration. Managed via the admin SPA and JSON:API endpoint.

Key classes: Media, MediaAccessPolicy, MediaServiceProvider.

Access scope (important)

MediaAccessPolicy gates the media record (the entity row) on the JSON:API surface — view/create/update/delete of the media entity. It does not gate the file bytes: uploads are written to the public:// scheme (storage/files, returned as a /files/<name> URL) and are served by the host's normal static path, not through an access-checked download route. There is currently no private:// scheme or authorized-download path for media (unlike attachment, which got GET /attachment/{id}/download with deny-by-default access in #1761). So a media entity's access policy does not protect its file contents from direct URL access — do not store sensitive bytes as public:// media expecting the entity policy to guard them.

The MediaType.source plugin id (file/image/oembed) is metadata only — the media source-plugin system (resolution, derivatives, gated downloads) is not implemented. Both — the source-plugin substrate and an authorized media download reusing the attachment PrivateFileStore — are tracked as a future feature in #1762.