File Storage Interview Questions

Upload should not stream every byte through my API if I can avoid it. I would give the client a pre-signed URL to S3 or equivalent. Metadata — name, owner, parent folder, version, ACL — lives in a database. Bytes live in object storage. Large files use multipart upload. Downloads go through a CDN. Sharing is an ACL table, not a boolean on the file row. I would version files as immutable objects and keep a pointer to current. Quota, trash, and restore are real product features I would mention. Virus scan is async after upload. Metadata I keep strongly consistent. The file bytes I treat as immutable blobs. I would not store 2 GB PDFs in Postgres.

The API should not stream 2 GB through the app pods. I issue a pre-signed URL to object storage and the client uploads directly, maybe in multipart chunks. The API only stores metadata when the upload completes, often via a callback or client finalize call. I would checksum chunks. I would not put a 30-second load balancer timeout in front of a giant PUT through Node.

Sharing is an ACL on the file metadata: user ids, groups, or a tokenized public link with optional expiry and password. Download goes through an auth check or a signed URL. I would not make the object bucket world-readable. Public links should be revocable. I mention audit logs for enterprise Drive-like products because Indian SaaS interviews care about that.

I store immutable versions in object storage and point metadata at the current version. Concurrent edits: last-write-wins with a version number, or conflict copies like Drive's 'conflicted copy'. I would not overwrite blobs in place. Dedup can use content hashes. I mention that sync clients need a change feed or cursor, not a full rescan every time.

Those are async workers. Upload complete event goes to a queue. Workers pull, scan, generate thumbnails, write derived objects, and update metadata. The user can see the original before thumbs exist. I would isolate scanners because they handle hostile files. I would not do virus scan in the upload request path if it adds seconds to every file.