Database Lifecycle Hooks
Automatic lifecycle synchronization and ownership checks from @dimah-s3/db.
The db() plugin automatically attaches guards and
synchronization actions across upload, download, and delete flows.
Access and scope validation
Route membership is still the server keyPrefix check (INVALID_KEY). These
plugin guards do not compare the stored route column to the request route.
They look up the row by (bucket, key) and compare scope.
Before an operation runs, @dimah-s3/db resolves the active session scope
through resolveScope(request):
| Situation | Response Status | Error Code |
|---|---|---|
resolveScope returns null | 401 Unauthorized | UNAUTHORIZED |
| Target key belongs to another scope | 403 Forbidden | FORBIDDEN |
| Target object row not found or soft-deleted | 404 Not Found | OBJECT_NOT_FOUND |
Lifecycle behavior by operation
- Upload — Upserts a
pendingrow on presign / multipart init. - Upload confirmation — Verifies
pendingstate (or refreshes an already-active overwrite), records verifiedcontentLengthfromHeadObject, and returns theactiverow. - Download — Enforces that the object has
status: "active"and matches the caller's scope. - Delete — Runs S3
DeleteObjectCommand, then updates row status to"deleted"(soft delete) or removes it (hard delete).
Frequently asked questions
Your route-level guard runs first during route resolution. After that, the
database plugin's operation guard verifies scope and ownership before your
operation-specific upload.guard, download.guard, or delete.guard. See the
standard plugin hook order.