Uploads, Shared Links, and Coauthoring APIs

These API families are where integration bugs usually become user-visible incidents.

Uploads

SynckHub uses in-process tus v1 endpoints and upload intent or session APIs.

Key rule:

  • respect size limits and lifecycle state; do not bypass finalize paths

Practical implication:

  • the upload is not done just because bytes reached temporary storage
  • the durable platform action happens only after the server-side finalize or finish path succeeds

Public link workflow includes:

  • create and revoke, authenticated
  • metadata read, unlock, list, content, and download on public token-gated routes

Token URLs are capability links. Treat them as sensitive credentials.

Server rule:

  • distribute the server-returned public_url; clients should not rebuild shared-link URLs from their current browser origin

Web rule:

  • public shared-link pages should resolve infra_key -> api_base_url from the web app’s version-controlled routing table and call the owning infra directly

Coauthoring

Two paths are supported:

  • Office WOPI action URL plus lock and save lifecycle
  • Yjs session mint plus websocket and callback lifecycle

For both paths, server-minted tokens and callback security secrets are mandatory.

Do not let clients mint or reinterpret these trust artifacts.

Failure patterns to avoid

  • rebuilding public URLs from the current browser origin
  • assuming one infra owns every public link
  • treating WOPI or Yjs tokens as reusable long-lived credentials
  • reporting “upload complete” before the server has accepted the durable final state
Previous
Troubleshooting
Next
Chats