# Upload Standard — AARJAY GDP Portal

`App\Helpers\UploadHelper` was added to standardise upload handling across modules.

## Why

Many GDP records reference evidence files: SOPs, Document Control, Forms, Training Certificates, Technical Agreements, Temperature Mapping reports, MHRA inspection evidence, Falsified Medicines photos, Defective Stock photos and accountant attachments.

Before production, modules that currently accept simple file paths can be migrated gradually to this helper.

## Helper class

```php
use App\Helpers\UploadHelper;

$result = UploadHelper::store('evidence_file', 'mhra_inspections', [
    'prefix' => 'MHRA',
    'max_bytes' => 20 * 1024 * 1024,
    'allowed_extensions' => UploadHelper::DEFAULT_EXTENSIONS,
]);

if ($result['error']) {
    $errors['evidence_file'] = $result['error'];
} elseif ($result['path']) {
    $d['evidence_file'] = $result['path'];
}
```

## Standard rules

- Never trust original filename as saved filename.
- Store only generated filenames under `/uploads/<module>/`.
- Block `..` path traversal.
- Keep allowed extensions module-specific.
- Default max size is 20 MB.
- Store relative paths such as `uploads/documents/FILE.pdf` in database.
- Do not allow PHP/script uploads.
- Production server should prevent script execution inside `/uploads`.

## Recommended folders

| Module | Folder |
|---|---|
| Document Control | `uploads/documents` |
| SOPs | `uploads/sops` |
| Forms/Templates | `uploads/forms_templates` |
| Training / Certificates | `uploads/training` |
| Technical Agreements | `uploads/technical_agreements` |
| Temperature Mapping | `uploads/temperature_mapping` |
| MHRA Inspections | `uploads/mhra_inspections` |
| Falsified Medicines | `uploads/falsified_medicines` |
| Defective Stock | `uploads/defective_stock` |
| Accounts | `uploads/accounts` |

## Migration plan

1. Keep existing path fields working.
2. Add file input fields alongside path fields.
3. Use UploadHelper to save files.
4. Store helper result path in the existing DB column.
5. Add Activity Log entry for uploaded evidence.
6. Later add central attachment table if multiple files per record are required.
