Organization file storage

The TENANT_FILES R2 binding stores private application files. Every object key begins with the active Better Auth organization ID, while PostgreSQL stores tenant-scoped metadata.

organizations/{organizationId}/{fileId}/{encodedFileName}

The Worker ignores browser-supplied organization IDs. It derives the active organization from the Better Auth session and revalidates membership before listing, uploading, downloading, or deleting.

The default file manager accepts PDF, DOCX, Markdown, images, CSV, JSON, and plain text up to 25 MB. Downloads use an authenticated Worker response with content sniffing disabled. Owners and admins can upload or delete; organization members can list and download.

Foundation document research accepts up to five supported text documents and 10 MB per run. Parsing happens in the separate read-only Grows Agent container with expanded-content, page, and extracted-text limits. Original objects remain private in R2; accepted evidence stores the tenant-scoped source file identifier.

Free organizations receive 100 MB. The default Pro entitlement raises storageMb to 10,240 MB. Usage is calculated from tenant-leading metadata before every upload; R2 is not called when the organization would exceed its quota.

For large media or public assets, add a separate bucket and an explicit access policy rather than making TENANT_FILES public.