FAQ

Uploads fail with a CORS error

The browser uploads straight to the storage, another origin than the dashboard's. Add every origin the dashboard is served on to the api module's cors.allowedOrigins. See Installation.

The upload queue says the storage cannot be reached

The storage's baseUrl is not reachable from the browser, for example an internal host name. Point the storage's baseUrl, and the module's publicBaseUrl, at the public URL of the API.

Copied links open a 404 on the dashboard

Since Media 0.4, the module declares /media/** to the dashboard's frontend server (backendProxies, with the session): a /media/... link on the dashboard's origin reaches the backend, and a private file opens for a signed-in member. A 404 there means the dashboard runs an older Media or renderer. Copied links still start with publicBaseUrl, the API's public URL, so they work outside the dashboard: set it to ${@api.API_PUBLIC_BASE_URL}.

The module fails to load after an upgrade

Media 0.5 requires @antelopejs/dms 0.9, @antelopejs/interface-dms >=0.7.2, the renderer @antelopejs/dms-frontend 0.6 and @antelopejs/interface-dms-media >=0.3.0 <0.4.0. Media 0.4 uses media interface 0.2. Upgrade the project along the DMS 0.9 upgrade guide, or keep Media ^0.3.0 on DMS 0.8. Troubleshooting covers dependency resolution and frontend integration errors. The data, the folders and the /media URLs do not change.

A member cannot see the folder of a field

The folder's rights come from the page that holds the field, and only an explicit grant of that page in the member's role counts. A page every member opens by default (memberAccess, publicAccess) grants no folder right. Grant the page to the role, or add a permissionMapping to the binding.

A member cannot make a file public

Changing the visibility of a file or a folder is reserved to the owner.

A private link asks me to sign in

Private files need a token. A browser without one is redirected to the file's page in the dashboard, which signs in and comes back. Scripts get a bare 401.

Current limitations

• Declared content (ImportMediaAsset) is written through a presigned URL from the backend, since interface-file-storage has no server-side write; with file-storage-local it waits for the API server to listen.
• Abandoned staged uploads are purged from the media_uploads table the module fills at presign (interface-file-storage exposes no listing).
• Folder visibility applies to the folder's direct assets (no recursive visibility inheritance); assets inherit or override individually.
• Cover cropping is centred (no focal point), and reference counting ("used in N records") is not supported yet.
• The AssetType field has no crop button: editing an image changes it everywhere it is used, and a crop per usage comes later.
• Replacing a file and a trash for deleted files are not available yet.
• AssetType validates the value's shape (asset-ID strings and, in multiple mode, the maximum count), not whether those IDs exist, belong to the tenant or match the allowed MIME types. Enforce those checks in the consuming write path; the picker's filter is not an authorization boundary.