Private Logistics Image Thumbnails: Signed URL Delivery and Per-Tenant Object Storage

Private thumbnail delivery in logistics apps involves keeping image bytes and resized variants in object storage, while preserving ownership and metadata in the database. The application then provides a short-lived signed URL to the browser, ensuring the UI can deliver images without making them public assets. The database is crucial for determining tenant ownership, storing image dimensions, processing state, and retention decisions.

It should not carry the image blobs themselves. The object key is useful for a second access check, but not an authorization policy. A naming convention like tenantId/userId/imageId/size.webp, followed by tenant and user verification, simplifies recovery and support exports. Backup and restore operations follow the same principle: the database stores snapshot information, and object storage holds the files.

Short-lived signed URLs are essential for security and efficiency. The URL's lifetime should correspond to the screen's job, whether it's a few minutes for a thumbnail request or longer for a background export with a separate audit trail. The separation of URLs from long-lived credentials also simplifies deletion, as a tenant removal transaction can handle database row marking, object deletion, and recording attempted deletions without a massive database transaction.

When deciding between using object storage or database blobs, the latter is beneficial for atomic updates with small records and querying through the same transaction. However, it becomes cumbersome with numerous thumbnails, backups, or application replicas moving bytes instead of serving shipment data. Database blobs also pose challenges with large binary columns, complex restore windows, and maintenance.

Object storage, on the other hand, offers direct byte delivery, many independent objects, and leaves metadata and authorization to the application. However, it requires coordination through a database record, naming convention, cleanup worker, and upload policy for failed uploads. In a tenant migration, deciding where to store older than 24-hour-old images, checking key prefix boundaries, recording checksums before resizing, and creating reconciliation jobs that explain mismatches are essential tasks. The database remains small and queryable, while storage handles bytes more efficiently.