Define the submission unit
Use one PDF or image application document per submission for the first version. Accept PDF, PNG and JPEG, leaving archives and video outside the initial scope. These are design choices for this example, not universal provider limits. Identify the submitting user and receiving staff. Ask the agent for separate states for no file, transferring, awaiting checks, accepted and returned for correction. Selecting a local file must not display a completed receipt.
Use browser checks for early feedback
Read the browser File object's name, size and type to provide immediate guidance. If this prototype chooses a five-MiB limit, label that unit and keep the value in shared configuration rather than copying different constants into several screens. Browser feedback helps users correct mistakes, but submitted metadata can be changed. The receiving endpoint must enforce its own rules; a file-picker filter is not a substitute for server validation.
Separate storage keys from filenames
Generate a storage identifier instead of using the customer's filename as a path. Preserve the original name only as display metadata and distinguish replacements by submission ID and version. Two documents called application.pdf should not overwrite each other. Keep storage private by default and authorize each retrieval for the relevant submission. Test another record's URL directly; hiding a download button does not protect the underlying document.
Accept only after receiving checks
Combine an allowed extension, content inspection and size rules at the receiving service. Do not trust one declared type. Where inspection requires a separate step, keep pending objects away from normal staff downloads until they pass. Store an operation key, storage reference, check state and receipt time. Transfer and record creation can fail independently, so reconcile them. Expire unused temporary objects with conditions that protect files attached to valid submissions.
Rehearse boundaries and duplicate names
Prepare files below, exactly at and above the chosen limit. Five MiB means five times 1,024 times 1,024 bytes in this example. Also include an empty file and content with a misleading PDF extension. Have two fictional users submit identical filenames and verify that each submission opens the correct object. Interrupt a transfer and confirm it does not become accepted. These are proposed acceptance cases rather than reported product measurements.
| Rehearsal condition | Expected outcome | Evidence to inspect |
|---|---|---|
| File equals the configured size limit | Pass the size rule | Bytes measured by the receiving service |
| Content does not match an allowed format | Do not accept the submission | Format-check result |
| Different users submit the same filename | Keep separate stored objects | Submission ID and storage key |
| Connection drops during transfer | Explain the incomplete state | Transfer state and submission record |
Five MiB is the example application's chosen limit. Format, size and access are separate checks.
Distinguish retries from replacements
A repeated transfer of the same submission should reuse its operation key and return the existing outcome when appropriate. A corrected document is a new version, linked to the earlier submission and staff comments. Record which version an approval concerns. An employee approving an old open preview must not accidentally accept the newest replacement. Decide retention for the actual files separately from the limited history needed to explain corrections or deletion.
Budget for retention and retrieval
Cursor usage concerns development; the deployed submission service also has storage, transfer, inspection and notification costs. Estimate average bytes, replacement frequency, staff download frequency and retention, not just monthly submissions. Start with small fictional documents, then increase the workload deliberately. Define a deletion owner and period rather than assuming indefinite retention. Align application limits with the actual receiving path and review the selected storage provider's current allowances and excess-use behavior.
Make the receipt explain the outcome
Show the submission ID, displayed filename, accepted version, time and expected next contact. Distinguish format, size, connection, permission and pending-check problems so users know what to change. If a staff member cannot open a document, investigate its record reference, object existence and authorization in that order. Do not repair an access error by making the entire storage area public. Keep a reconciliation path for pending objects after an intake outage.
Official sources
Pricing, availability and feature limits can change. Check the linked official pages before subscribing.
- MDN — FileInformation checked: 2026-10-30
- OWASP — File Upload Cheat SheetInformation checked: 2026-10-30
- Next.js — FormsInformation checked: 2026-10-30
- Cursor pricingInformation checked: 2026-10-26
- Cursor models and pricingInformation checked: 2026-10-26
- Cursor Agent overviewInformation checked: 2026-10-26