Media Repository - Feature Inventory¶

Repository: PsyterMediaUploadAPI
Audit Date: November 10, 2025
Purpose: Comprehensive inventory of features, capabilities, and dependencies

Table of Contents¶

• Core Features
• Technical Capabilities
• Integration Points
• Dependencies
• Database Dependencies
• Feature Matrix
• API Endpoints
• Future Enhancements

Core Features¶

1. Authentication & Authorization¶

Dependencies:
- Microsoft.Owin.Security.OAuth (3.1.0)
- Microsoft.Owin.Cors (3.1.0)
- Main Psyter API for ApplicationToken

Integration: Main API → ApplicationToken → Media API → Bearer Token

2. File Upload Management¶

Dependencies:
- System.Net.Http.Formatting (5.2.7)
- Custom UploadMultipartFormProvider

File Categories Supported:
1. ProfileImage (1 file, images only)
2. EducationHistory (3 files max, docs + images)
3. SCRC (multiple files, docs + images)
4. ShortBio (1 file, video only)
5. PaymentAttachment (1 file, docs + images)
6. HomeWork (multiple files, docs + images + text)
7. HomeWorkSubmission (multiple files, docs + images + text)
8. ArticleImages (multiple files, images only)
9. AgreementAcceptance (1 file, images only)
10. BookingInvoices (multiple files, PDF only)
11. NationalID (multiple files, images only)

3. File Storage & Organization¶

Storage Structure:

/Media/
├── {UserType}/
│   └── User_{UserId}/
│       ├── ProfileImage/
│       ├── EducationHistory/
│       ├── SCRC/
│       ├── ShortBio/
│       ├── PaymentAttachment/
│       ├── HomeWork/
│       │   └── HomeWork_{HomeWorkId}/
│       ├── HomeWorkSubmission/
│       │   └── HomeWork_{HomeWorkId}/
│       ├── AgreementAcceptance/
│       └── NationalID/
├── ActicleImages/
└── BookingInvoices/

Dependencies:
- File system permissions
- Configurable base path from database

4. PDF Generation¶

Dependencies:
- iTextSharp (5.5.13.4)
- itextsharp.xmlworker (5.5.13.4)
- Custom fonts (ProximaNova, Alexandria, NotoSansArabic)
- HTML templates (English/Arabic)

PDF Generation Features:
- Agreement template retrieval from database
- Placeholder replacement: USER_NAME, AGREEMENT_CONTENT, IMG_SIGNATURE, CURRENT_DATE, BASE_URL
- Automatic language detection (Arabic regex)
- Page numbering
- Custom footer with URL, logo, page number
- Automatic PDF combination (Arabic + English)

5. File Deletion¶

Dependencies:
- MediaRepository.DeleteMediaFromDB()
- File system access
- Database stored procedure: HW_DeleteHomeWorkFile

Supported Categories:
- HomeWork (6)
- HomeWorkSubmission (7)

6. Data Management¶

Dependencies:
- SQL Server
- Custom encryption (SecurityHelper, Cryptography)
- Stored procedures
- DataTable/DataReader mapping

7. Security Features¶

Security Implementations:
- OAuth 2.0 with MyAuthorizationServerProvider
- AES-256 for connection strings
- DES for general encryption
- SHA-256/SHA-512 for hashing
- MD5 for password hashing (⚠️ weak)
- Base64 content signature validation

Security Concerns:
- AllowInsecureHttp = true (HTTP allowed)
- Hardcoded encryption keys
- Machine key in Web.config
- No malware scanning
- No rate limiting
- Persist Security Info = True

8. Error Handling & Logging¶

Error Response Format:

{
  "Data": null,
  "Status": 0,  // 0=Error, 1=Success
  "Reason": 3,  // Error code
  "ReasonText": "Invalid Parameters"
}

Error Codes:
- 2: EMPTY_PARAMETERS
- 3: INVALID_PARAMETERS
- 4: SQL_SERVER_EXCEPTION
- 5: NOT_FOUND
- 6: CANT_DELETE
- 7: PHYSICAL_DIRECTORY_NOT_FOUND
- 8: INVALID_MIME_TYPE
- 9: CANT_UPLOAD_MORE_THAN_ONE_FILE
- 10: CANT_UPLOAD_MORE_THAN_3_FILES
- 11: FILE_SIZE_IS_LARGER_THAN_ALLOWED
- 12: FILE_EXTENSION_NOT_ALLOWED
- 13: FILE_MIMETYPE_NOT_ALLOWED

Technical Capabilities¶

Programming Features¶

Framework Features¶

Integration Points¶

1. Main Psyter API Integration¶

Direction: Bidirectional
Purpose: Authentication and user validation

Inbound:
- Receives ApplicationToken for authentication
- Validates token via database

Outbound:
- Returns file paths to main API
- Updates database shared with main API

Endpoints:
- POST /authenticate

2. Database Integration¶

Type: SQL Server
Connection: Encrypted connection string
Purpose: Data persistence and configuration

Stored Procedures:
1. User_Authenticate_MediaAPI - Validate ApplicationToken
2. AppConfig_GetAppConfigSettingsByGroupId - Get configuration
3. HW_SaveHomeWorkFilesDetail_FromMediaServer - Save homework files
4. HW_DeleteHomeWorkFile - Delete homework files
5. SP_GetUserAgreementData - Get agreement template
6. SP_UpdatetUserAgreementFilePath - Update agreement paths

Tables Used (indirectly):
- AppConfiguration
- User/Account tables
- HomeWork tables
- Agreement tables

3. File System Integration¶

Type: Local/Network file system
Purpose: Physical file storage

Operations:
- Create directories
- Write files
- Read files (for PDF generation)
- Delete files

Path Configuration:
- Retrieved from AppConfiguration table
- Configurable per environment

4. Client Applications Integration¶

Supported Clients:
- Android app (CareProvider)
- Android app (Client)
- iOS app (CareProvider)
- Web application
- Admin portal

Integration Method:
1. Client authenticates with main API
2. Receives ApplicationToken
3. Requests bearer token from Media API
4. Uses bearer token for uploads

Dependencies¶

Framework Dependencies¶

NuGet Packages¶

Core Packages¶

Security Packages¶

PDF Generation¶

⚠️ Critical Issue: iTextSharp is no longer maintained. Last update was 2019. No security patches.

Cryptography¶

Utilities¶

Development Dependencies¶

Database Dependencies¶

Stored Procedures¶

Authentication¶

User_Authenticate_MediaAPI
  @ApplicationToken NVARCHAR(MAX)
  @StatusCode SMALLINT OUTPUT

Configuration¶

AppConfig_GetAppConfigSettingsByGroupId
  @GroupId INT

Homework Files¶

HW_SaveHomeWorkFilesDetail_FromMediaServer
  @HomeWorkId BIGINT
  @xmlData XML
  @Status SMALLINT OUTPUT

HW_DeleteHomeWorkFile
  @UserId BIGINT
  @MediaFileId BIGINT
  @MediaCategory TINYINT
  @Status SMALLINT OUTPUT

Agreement¶

SP_GetUserAgreementData
  @UserLoginInfoId BIGINT

SP_UpdatetUserAgreementFilePath
  @UserLoginInfoId BIGINT
  @AgreementPDFFilePath NVARCHAR(500)
  @SignatureFilePath NVARCHAR(500)
  @Status SMALLINT OUTPUT

Feature Matrix¶

Upload Category Feature Comparison¶

Validation Feature Matrix¶

API Endpoints¶

Summary¶

Endpoint Details¶

Authentication Endpoints¶

• POST /authenticate
• Input: ApplicationToken
• Output: Bearer token (24h validity)
• Rate Limit: None ⚠️
• Validation: Token validity check

Media Endpoints¶

• POST /Media/UploadMedia
• Input: UserId, UserType, UploadCategory, File(s), optional params
• Output: File details (FileName, FilePath, FileType)
• Validation: Multi-layer (MIME, extension, size, content)
• Rate Limit: None ⚠️
• Max Size: 100 MB per file

• Max Files: Varies by category (1, 3, or unlimited)

• POST /Media/DeleteMediaFile

• Input: UserId, MediaId, MediaCategory
• Output: Success/failure status
• Validation: Category must be HomeWork or HomeWorkSubmission

• Side Effect: Deletes physical file and DB record

• POST /Media/RegenrateAgreement

• Input: UserLoginInfoId, FullName, SignatureMediaPath
• Output: PDF file details
• Processing: Generates bilingual PDF, combines, saves
• Side Effect: Updates database with new PDF path

Future Enhancements¶

Critical Priority¶

1. Malware Scanning
   - Integrate antivirus scanning for uploaded files
   - Block suspicious file types
   - Quarantine flagged files
   - Impact: Security

2. HTTPS Enforcement
   - Disable HTTP for OAuth
   - Require SSL certificates
   - Update all URLs
   - Impact: Security

3. Comprehensive Logging
   - Implement structured logging
   - Log all file operations
   - Track authentication attempts
   - Error logging with stack traces
   - Impact: Observability

High Priority¶

4. Migrate to .NET Core
   - Upgrade to .NET 6/8
   - Replace OWIN with native middleware
   - Better performance and security
   - Impact: Modernization

5. Replace iTextSharp
   - Migrate to QuestPDF or PdfSharpCore
   - Actively maintained library
   - Better licensing
   - Impact: Maintainability

6. Rate Limiting
   - Implement request throttling
   - Prevent abuse
   - Configurable limits per user/IP
   - Impact: Security & Performance

7. Cloud Storage Integration
   - Support Azure Blob Storage
   - Support AWS S3
   - Better scalability
   - Impact: Scalability

8. Dependency Injection
   - Implement DI container
   - Better testability
   - Loose coupling
   - Impact: Maintainability

Medium Priority¶

9. CDN Integration
   - Serve files via CDN
   - Better performance
   - Reduced server load
   - Effort: 1-2 weeks
   - Impact: Performance

10. Image Optimization

    • Auto-resize images
    • Compress uploads
    • Generate thumbnails
    • Effort: 1-2 weeks
    • Impact: Performance

11. Chunked Upload Support

    • Support large file uploads
    • Resume capability
    • Progress tracking
    • Effort: 2-3 weeks
    • Impact: User Experience

12. Unit Testing

    • Add comprehensive tests
    • Code coverage > 80%
    • Integration tests
    • Effort: 3-4 weeks
    • Impact: Quality

Low Priority¶

13. API Documentation (Swagger)

    • Auto-generated docs
    • Interactive testing
    • Client code generation
    • Effort: 1 week
    • Impact: Developer Experience

14. File Versioning

    • Keep file history
    • Restore previous versions
    • Audit trail
    • Effort: 2 weeks
    • Impact: Data Safety

15. Storage Quotas

    • Per-user storage limits
    • Warning notifications
    • Auto-cleanup policies
    • Effort: 1-2 weeks
    • Impact: Cost Control

Missing Features Analysis¶

Security Gaps¶

Operational Gaps¶

User Experience Gaps¶

Dependency Risk Assessment¶

High Risk Dependencies¶

iTextSharp (5.5.13.4)
- Status: Unmaintained since 2019
- Risk: Security vulnerabilities, no bug fixes
- Impact: PDF generation is core feature
- Mitigation: Plan migration to QuestPDF or similar
- Timeline: 3-6 months

OWIN (3.1.0)
- Status: Legacy, replaced by ASP.NET Core
- Risk: No new features, limited support
- Impact: Authentication framework
- Mitigation: Migrate to .NET Core
- Timeline: 6-12 months

Medium Risk Dependencies¶

Newtonsoft.Json (11.0.2)
- Status: Outdated but maintained
- Risk: Missing newer features
- Impact: JSON serialization
- Mitigation: Update to latest or use System.Text.Json
- Timeline: 1-3 months

BouncyCastle (1.8.9)
- Status: Old version
- Risk: Potential security issues
- Impact: Cryptography operations
- Mitigation: Already have 2.4.0, consolidate usage
- Timeline: 1 month

Integration Complexity Matrix¶

Conclusion¶

The Media repository provides essential file management functionality with 44 implemented features across 8 major categories. While core capabilities are solid, there are significant gaps in security (malware scanning, HTTPS), operational (logging, monitoring), and modern architecture (DI, testing).

Feature Maturity: 60%
Security Posture: 65%
Maintainability: 55%
Future-Readiness: 45%

Priority Recommendations:
1. Add malware scanning (Critical)
2. Implement comprehensive logging (Critical)
3. Enable HTTPS-only (Critical)
4. Plan .NET Core migration (High)
5. Replace iTextSharp (High)
6. Add rate limiting (High)
7. Implement dependency injection (Medium)
8. Add unit tests (Medium)