@intakeguard/multer

Multer 2 storage engine backed by @intakeguard/core. It validates content in quarantine, shares an aggregate request budget across files, and exposes detected type metadata on the accepted Multer file.

The adapter keeps Multer responsible for multipart parsing and lets IntakeGuard handle what Multer does not decide: validating untrusted bytes, enforcing a request-wide budget, scanning before promotion, and cleaning up rejected files.

Example

import multer from "multer";
import { createClamAvScanner } from "@intakeguard/core";
import { intakeGuardStorage } from "@intakeguard/multer";

const upload = multer({
  storage: intakeGuardStorage({
    quarantineDir: "/var/lib/app/quarantine",
    destinationDir: "/var/lib/app/uploads",
    maxFileBytes: 10 * 1024 * 1024,
    maxRequestBytes: 25 * 1024 * 1024,
    allowedMimeTypes: ["application/pdf", "image/png", "image/jpeg"],
    scanner: createClamAvScanner()
  })
});

app.post("/upload", upload.single("file"), handler);

Requires Multer 2 and Node.js 18 or newer. Keep upload storage outside the public web root. See the project README for production guidance.