File

The file type handles uploads of non-image files — PDFs, documents, archives, etc. Like image, uploads are stored as asset references so the same file can be reused across documents.

Definition

import type { FileField } from '@aphexcms/cms-core';

{
  name: 'datasheet',
  type: 'file',
  title: 'Datasheet'
}

Properties

Stored data

Files are stored as a reference to an asset record — the same shape used by image:

{
  _type: 'file',
  asset: {
    _type: 'reference',
    _ref: 'asset-id'
  }
}

The asset record tracks the original filename, MIME type, size, and storage adapter used.

Accepted file types

accept supports MIME types, MIME wildcards, and filename extensions. Pass either a comma-separated string or an array:

// MIME type: matched against the file's detected content when uploaded through the server
accept: 'application/pdf';

// Extension: matched against the filename
accept: '.pdf';

// Either representation can be combined
accept: ['application/pdf', '.pdf', '.docx'];

// Wildcard MIME type
accept: 'audio/*';

Prefer a MIME type when one is available. Extension rules are useful for formats whose browser MIME type is missing or inconsistent. Supplying both allows either representation to match; all uploads still pass Aphex's global checks for blocked executable and active-content formats.

When accept is omitted, a file field accepts any file that passes those global safety checks. The rule also applies to drag-and-drop, uploads from the asset picker, direct-to-storage upload grants, and existing assets selected from the library.

An installation may also configure upload.allowedMimeTypes. Files must satisfy both policies: a field can narrow the global MIME allow-list, but cannot widen it. The global list is the security boundary; field accept is an authoring constraint for that field.

Examples

PDF-only upload

{
  name: 'brochure',
  type: 'file',
  title: 'Brochure',
  accept: ['application/pdf', '.pdf'],
  maxSize: 10 * 1024 * 1024, // 10 MB
  validation: (Rule) => Rule.required()
}

Private download

{
  name: 'contract',
  type: 'file',
  title: 'Signed Contract',
  accept: ['application/pdf', '.docx'],
  private: true
}

Private files are served from /media/[id]/[filename] only if the requester has a valid session for the owning organization, or presents a signed URL — which is how you hand a file to someone who has no admin account.