Skip to main content

Buckets

The platform uses two private S3 buckets. Nothing in either bucket is public. Both buckets keep old versions of each file. The browser uploads straight to S3 with a presigned URL. The API then checks the file and moves it into place. A report file can be up to 200 MB. Locally, files go to a folder on disk instead of S3. See apps/api/src/storage.ts.

How a copy is made

Every copy of a report carries the reader’s name. The code is in apps/api/src/deliveries.ts and watermark.ts.
1

A copy is queued

A card purchase, a paid invoice, a manual grant, or a buyer’s click on Download a copy adds a row to report_deliveries.
2

The API wakes a runner

It sends a request to its own /internal/deliveries/run. The copy then has a request of its own, so a task that shuts down cannot stop it before it is complete.
3

The runner stamps the PDF

The runner writes the footer line, the faint diagonal name, and the copy number in the file properties and in the spacing between words.
4

The API stores the copy and emails the buyer

The copy goes to deliveries/ in the reports bucket, and the buyer gets the “Your copy of …” email.
An EventBridge schedule calls /internal/deliveries/wake every five minutes. The next sweep makes any copy whose run stopped. Both internal routes need the key in the oncoeverything/delivery-runner-key secret. The API task has 1 vCPU and 2 GB of memory, because stamping holds a large PDF in memory several times. Measure before you lower it. A download goes through downloads.oncoeverything.com, a CloudFront distribution in front of the reports bucket.
  • The API signs each link with a CloudFront key pair. The private key is in the oncoeverything/app secret, and Terraform holds only the public key.
  • CloudFront can read only deliveries/. CloudFront never serves master files or samples.
  • A link lasts seven days at most, or until access ends.
  • report_delivery_opens records each visit to a link.

Identify a file

Identify a file posts a PDF to the API’s /identify. The API reads the copy number from the file properties, or from the word spacing if someone removed them. The file can be up to 100 MB.