type, title, description, tags, timestamp
| type |
title |
description |
tags |
timestamp |
| api |
Uploads Endpoints |
Admin-only multipart upload endpoints for category icons and challenge files. |
| api |
| uploads |
| multipart |
| admin |
|
2026-07-21T18:28:00Z |
Endpoints
| Method |
Path |
Auth |
Source |
POST |
/api/v1/uploads/category-icon |
Admin |
backend/src/modules/uploads/uploads.controller.ts |
POST |
/api/v1/uploads/challenge-file |
Admin |
Same. |
Guard chain
Both handlers are gated by JwtAuthGuard + AdminGuard. CSRF is enforced
(standard cookie + header pattern; nothing is added to the skip list).
Behavior
- Each endpoint uses
FileInterceptor('file') and parses a single
multipart part named file.
- File size is validated by
parseUploadSizeLimit() in
backend/src/common/utils/upload.ts.
- Filenames are sanitized by the same helper before being persisted
under
UPLOAD_DIR.
See also
OpenVelo Agent