FormForge Backend
Upload Modes and Drafts
Managed, direct, and staged upload workflows plus owner-bound draft behavior.
Upload modes
Config: formforge.uploads.mode
Values:
manageddirectstaged
Staged flow:
- stage file via upload endpoint
- submit JSON payload with upload token reference
Antivirus scanning
Managed and staged uploads can be scanned through the HTTP API provided by ajilaag/clamav-rest.
FORMFORGE_CLAMAV_ENABLED=true
FORMFORGE_CLAMAV_ENDPOINT=https://clamav.example.com/v2/scan
FORMFORGE_CLAMAV_USERNAME=clamav-client
FORMFORGE_CLAMAV_PASSWORD=secret
FORMFORGE_CLAMAV_TIMEOUT=30
The endpoint must accept a multipart field named file. A clean response is HTTP 200; an infected response is HTTP 406. When scanning is enabled, scanner errors reject the upload. Basic authentication is optional. The scanner is disabled by default.
Direct uploads reference files already stored elsewhere and are not scanned by FormForge.
Drafts
Drafts are owner-bound:
- one draft per
(form_key, owner_type, owner_id) - optional expiration via
drafts.ttl_days - draft endpoints require authenticated owner