PDF Storage (Azure)

All Founder File PDFs are stored in Azure Blob Storage under a deterministic path structure. The CP upload step hands the file to a server endpoint which writes to Azure and returns the blob URL plus computed metadata.

Path structure

Container: `founder-files`. Per-file folder: `{slug}/`. Per-language file: `{lang}/v{N}.pdf` where lang ∈ {en, ar, fr} and N is the version (1-based).

Example: `founder-files/before-you-ask-for-funding/en/v3.pdf`. Cover image: `founder-files/{slug}/cover.jpg`.

Versioning policy

• Last 5 versions retained per language. Older versions auto-purged on the 6th replace.
• Leads that already received an older version keep a reference to it; if the user re-downloads later they get the current `vN`.
• The CP "History" tab on each file lists all retained versions with size, page count, uploader, and date.

Access control

• Stored blobs are PRIVATE — never directly accessible by public URL.
• Public download flow generates a short-lived signed URL (SAS token, TTL = 1 hour) on every download request.
• Admin CP previews use a longer-lived SAS (TTL = 30 days, auto-refreshed) for the edit page preview pane.
• Hotlinking is impossible — the SAS expires before mirror sites can index it.

Upload constraints

• Max size: 50 MB per PDF. Larger uploads rejected client-side before upload starts.
• MIME validation: `application/pdf` only. Server re-validates after upload (defence-in-depth).
• Virus scan: every upload is scanned by Azure Defender before being made available to the CP.
• Failed uploads (size, MIME, virus): user sees specific error, blob is not retained.