Short answer: for a B2B SaaS product accepting private user uploads, let a Next.js server action authorize a short-lived upload session, let the browser send bytes directly to private object storage, and issue an expiring download URL only after a separate read authorization check.

The deciding constraint is not upload speed. It is the boundary between access control and delivery simplicity. The application must decide who may create, replace, download, and delete a file; storage should carry the bytes without becoming the application's user database.

What must the server action prove before a private upload exists?

The server action should accept only file metadata and an upload ID, derive the user from the authenticated session, validate size and content type against policy, create the database row, and request a presigned write. The browser then performs the direct upload with that URL. Afterward, a second server action checks the object and marks the row ready.…