dropthejase takes the browser out of the upload trust chain

File uploads now flow through short-lived URLs the backend hands out, so the browser never holds cloud credentials.

securityinfrastructure

Previously, the browser carried its own identity into Amazon's storage layer to upload files - a common pattern, but one that hands a lot of trust to code running on someone else's laptop. dropthejase rewired uploads into a three-step handshake: the backend issues a single-use upload link, the browser pushes the file straight to storage, and the backend then registers it.

The knock-on effect is the interesting part. With the browser no longer needing cloud credentials, the team ripped out the identity-broker service that used to mint them. Less moving parts, smaller blast radius if a session is ever compromised, and - usefully for anyone watching this fork - the pattern isn't locked to Amazon. The same shape works on any major cloud.

So what Worth a look for any legal-tech team uploading client files from a browser: it's a tidy template for shrinking what the front-end is trusted to do.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

7 commits from dropthejase/louis, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`3985ac4f`	feat: replace multipart upload with direct S3 prepare/upload/register flow	Jason Lee	2026-05-11	↗ GitHub
commit body - Add POST /single-documents/prepare and /:documentId/register - Add POST /projects/:projectId/documents/prepare and /documents/:documentId/register - Remove handleDocumentUpload, extractStructureTree, countPdfPages - Remove multipart POST / and POST /:projectId/documents routes - Replace uploadStandaloneDocument and uploadProjectDocument in mikeApi.ts with 3-step prepare→S3 uploadData→register flow
`c8ebfa45`	docs: mark upload refactor complete in FEATURE-PARITY.md	Jason Lee	2026-05-11	↗ GitHub
`af14662b`	docs: update ARCHITECTURE.md upload flow to reflect direct S3 prepare/register	Jason Lee	2026-05-11	↗ GitHub
`61e73c12`	fix(upload): replace Amplify Identity Pool upload with backend presigned S3 PUT URLs	Jason Lee	2026-05-12	↗ GitHub
commit body - /prepare endpoints now generate presigned PutObject URLs (15 min TTL) - Frontend uploads via XHR PUT to presigned URL - no AWS credentials on client - Revert IAM auth role to original cognito-identity sub variable; remove PutObject - S3 paths stay as user pool sub (consistent with DB user_id) - Update ARCHITECTURE.md and FEATURE-PARITY.md to reflect new upload flow
`f14a2d96`	Merge main into development	Jason Lee	2026-05-16	↗ GitHub
`703ad3a2`	refactor(auth): remove Cognito Identity Pool - uploads use presigned URLs	Jason Lee	2026-05-16	↗ GitHub
commit body Identity Pool credentials were issued but never consumed. All uploads go through backend-generated presigned URLs (mikeApi.ts). Removes: - CfnIdentityPool, AuthenticatedRole, per-user S3 bucket policy (AuthStack) - AwsContext.tsx, credentials.ts, storage.ts (dead frontend code) - VITE_IDENTITY_POOL_ID env var and amplifyConfig Storage/identityPoolId Also updates README highlight to reflect AgentCore microVM isolation instead of the now-removed Identity Pool isolation claim.
`04adf9ac`	Merge development into main	Jason Lee	2026-05-16	↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-341.md from inside the repo you want the changes in.

⬇ Download capture-thread-341.md