Petal Pro 4.3: Private file uploads, R2 and Tigris, and SAML SSO

Petal Pro 4.3 is out, and it’s all about file storage, with a couple of enterprise extras thrown in.

Private file uploads

Until now, file uploads in Petal Pro went into a public bucket. That’s fine for avatars and marketing images, but not for anything you’d rather keep behind a login.

4.3 adds a private mode. Set private: true on your :s3 config and the public-read ACL goes away. consume_uploaded_entries/2 stores just the object key in your database instead of a public URL, and when you want to show the file you call PetalPro.FileUploads.download_url/1, which hands back a short-lived presigned GET URL.

The nice part: download_url/1 is a no-op for public buckets and every other provider, so you can call it unconditionally in your templates and it does the right thing either way.

Cloudflare R2 and Fly Tigris

If you’d rather not be on AWS, 4.3 speaks Cloudflare R2 and Fly Tigris out of the box. Point a single endpoint config line at either one (or any S3-compatible service) and uploads, downloads and deletes all run through the same presigned path. Both ride on the existing S3 provider, so there’s nothing new to learn.

Old files get cleaned up

When a user replaces or clears their avatar, the previous file now gets deleted from storage automatically. Small thing, but it means you stop slowly piling up orphaned files (and the storage bill that comes with them).

SAML SSO recipe

For the enterprise crowd, there’s a new /recipes:add-saml-sso walkthrough that wires up SAML 2.0 against the usual identity providers - Okta, Microsoft Entra, Google Workspace - with the security prerequisites spelled out so you don’t miss anything important.

Upgrading

4.3 is a normal minor upgrade. Grab the new version from your projects page, and check the changelog and upgrade guide for the details.