[Version: ] 2.1.2 Problems with large attachments

[hhackbarth]

Bug-Description
Uploading a large attachment (e.g. a video file with 368 MB) seems to work, but you do not get any visible feedback, when the upload has finished. I could only recognize, that the order of the attachments changed after some time (there was another attachment already added to that object).

Malware scanning seems to fail but also without visible feedback. The attachment stays permanently in status "Scanning". That means, you cannot open it as long as it does not reach status "clean".

The error message, when opening this attachment also is handled as expected. The user only sees a JSON formatted text saying:
{
"error": {
"message": "Unable to download the attachment as scan status is not clean.",
"code": "403",
"@Common.numericSeverity": 4
}
}

To Reproduce
See bug description.

Expected behavior
Some kind of visible feedback during the upload of large documents or at least something that indicates clearly when the upload has finished.
Malware scan also working for large files.
Better error handling in case attachment is not yet "clean", not just JSON text.

[ ] is it a regression issue?

[hhackbarth]

Additional information:
The "upload-limit" can be found here: https://github.com/cap-js/attachments/blob/bb661c2a5155ea335c3c33fe791b65fb6479b8d1/lib/plugin.js
(Line 122: const MAX_FILE_SIZE = 419430400 //400 MB in bytes)

But the problem is even worse:
When you deploy your app and an app-router comes into the game, downloads are limited at a size around 30 MB, which make the attachment plugin useless for a lot of use cases.

You could overcome that problem, when redrecting to "presigned URLs" functionality, which AWS provides for S3 buckets as described here: https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html

[RoshniNaveenaS]

Hello @hhackbarth ,
We’ve reviewed the concerns and would like to share some updates and context:

Error Handling
The error handling part has been improved and addressed in a recent PR.

Limited Visible Feedback on Large Uploads
The lack of visible feedback during large uploads is a known limitation of the standard UI5 upload controls (especially with Fiori Elements). Since the upload happens in the background, there’s no progress indicator or completion confirmation. This behavior is outside the scope of the attachment plugin, but we will update as soon as the UI5 team update.

Malware Scanning Limitation
We internally use the SAP Malware Scanning Service, which has payload size and duration limits(400MB) that may cause scans to fail.

On Download Limitations via AppRouter
We recognize the value of this approach and consider it a feature enhancement that we plan to explore and support in the future.

[hhackbarth]

Thanks for your review and comments.

We’ve decided to move away from the attachments plugin. While we appreciate the concept and the effort behind it, we ran into constraints we couldn’t reconcile with production needs—most notably the AppRouter download/downstream limit of roughly 30 MB. We realize this cap isn’t introduced by the plugin itself, but any production-ready setup needs to work around it. In addition, even after about two years of development, we still encounter persistent issues around the object store and Postgres usage, which makes the plugin not yet a fit for our production environment.

To address this, we implemented our own approach using S3 presigned URLs. This removes file-size constraints and enables multipart uploads with a progress indicator—the standard experience users expect when handling large files.

The implementation, completed with the help of Copilot and Claude, took about two days—significantly less time than we had previously invested trying to make the attachment plugin work for our use case. We’ll keep an eye on future releases.