File Upload System

public async Task UploadChunkAsync(string uploadId, Stream chunk, long offset, CancellationToken cancellationToken = default)
{
    if (!_sessions.TryGetValue(uploadId, out var session))
    {
        throw new InvalidOperationException($"Upload {uploadId} not found");
    }

    // Opens or appends chunk data depending on the current offset
    await using var fileStream = new FileStream(
        session.TempPath,
        offset == 0 ? FileMode.Create : FileMode.Append,
        FileAccess.Write
    );

    await chunk.CopyToAsync(fileStream, cancellationToken);
    session.UploadedBytes = fileStream.Length;
}

public class ImageService : IImageService
{
    public async Task<string> UploadAsync(IFormFile file, ImageUploadOptions options)
    {
        // 1. Validate file type (JPEG, PNG, WebP)
        ValidateImageType(file);
        
        // 2. Validate file size (max configurable, default 5MB)
        ValidateFileSize(file, options.MaxSize);
        
        // 3. Read and process image
        using var image = await Image.LoadAsync(file.OpenReadStream());
        
        // 4. Resize if needed (maintains aspect ratio)
        if (image.Width > options.MaxWidth || image.Height > options.MaxHeight)
        {
            image.Mutate(x => x.Resize(new ResizeOptions
            {
                Size = new Size(options.MaxWidth, options.MaxHeight),
                Mode = ResizeMode.Max
            }));
        }
        
        // 5. Save to storage via IBlobStorage
        var path = $"{options.Folder}/{Guid.NewGuid()}.webp";
        await _blobStorage.UploadAsync(path, imageStream, "image/webp");
        
        return path;
    }
}

public class FileService : IFileService
{
    public async Task<string> SaveFileAsync(Stream stream, string fileName, string scheme, string? preferredFileName = null, CancellationToken cancellationToken = default)
    {
        var settings = GetSettings(scheme);
        var extension = Path.GetExtension(fileName).TrimStart('.').ToLowerInvariant();

        // 1. Validate extension against whitelist
        if (settings.AllowedExtensions != null && !settings.AllowedExtensions.Contains(extension))
            throw new InvalidOperationException($"File type '{extension}' is not allowed");

        // 2. Validate size
        if (stream.Length > settings.MaxFileSizeBytes)
            throw new InvalidOperationException($"File size exceeds maximum");

        // 3. Magic-byte signature validation (S0.12)
        if (stream.CanSeek)
        {
            var originalPos = stream.Position;
            if (!ValidateMagicBytes(stream, extension))
                throw new InvalidOperationException("File content does not match declared extension.");
            stream.Position = originalPos;
        }

        // 4. Save to destination
        var uniqueFileName = preferredFileName ?? $"{Guid.NewGuid():N}.{extension}";
        if (!_blobStorageSettings.Provider.Equals("local", StringComparison.OrdinalIgnoreCase) && IsPublicScheme(scheme))
        {
            var contentType = GetContentType("." + extension);
            return await _blobStorage.UploadAsync(scheme, uniqueFileName, stream, contentType, cancellationToken);
        }

        var relativePath = Path.Combine(settings.StoragePath!, uniqueFileName);
        var absolutePath = GetAbsolutePath(relativePath);
        Directory.CreateDirectory(Path.GetDirectoryName(absolutePath)!);

        await using var fileStream = new FileStream(absolutePath, FileMode.Create);
        await stream.CopyToAsync(fileStream, cancellationToken);
        return $"{settings.RequestPath}/{uniqueFileName}";
    }
}

// Static file middleware for uploaded files
app.UseStaticFiles(new StaticFileOptions
{
    FileProvider = new PhysicalFileProvider(settings.StoragePath),
    RequestPath = "/uploads",
    ServeUnknownFileTypes = false,
    DefaultContentType = "application/octet-stream"
});

uploads/
└── {tenant-id}/
    ├── admins/{admin-id}/profile.webp
    ├── logos/tenant-logo.png
    └── documents/{file-id}.pdf