- Shipped
- November 8, 2026 at 2:36 AM UTC
- Author
- Kamo
- Commit
- 33e7e17
The resource library has never stored a file. KbMediaService wrote to the constant bucket "kb" — two characters, below S3's three-character minimum — so minio-java refused every put and every presign before a byte left the pod. kamo.minio.bucket was in the ConfigMap all along; nothing read it. - Bucket comes from kamo.minio.bucket (now kb-resources), validated against S3 naming with a safe default; ensureBucketExists still creates it. - The KB MinIO client signs with the site region (us-west-ca-s-1), as the shared client does; minio-java's us-east-1 default is rejected. - New GET /api/kb/media/{id}/content streams the bytes from MinIO (no byte[]), single Range -> 206, 416, HEAD, ETag/304, private caching, nosniff + sandbox CSP, inline only for raster images/PDF/audio/video. Same access as before: own org, else platform help this reader may read, then the Antivirus verdict (423 ANTIVIRUS_BLOCKED / ANTIVIRUS_CHECKING). - presignedUrl (list, batch, single, platform help) now carries that same-origin path instead of a signature for the in-cluster MinIO host no browser can resolve. Locked or missing objects still get no URL.