One PostgreSQL schema per tenant
Requests set the search path inside a transaction; a missing tenant predicate cannot cross a boundary.
dam.rs GitHub Rights-aware digital asset management
Find every asset.
Prove you can use it.
Search, rights, provenance, storage and delivery in one auditable workflow—built in Rust for teams that cannot afford to guess.
Active development Core workflows are implemented; launch gates remain explicit.
Delivery decisionAllowed · 48 ms
ProvenanceVerified chain
143API paths
190operations
12Rust crates
46migrations
28UI surfaces
The one idea
Rights are enforced where bytes leave.
A badge is context. A signed URL is permission to attempt. The real decision happens when the asset is fetched, against the latest evidence.
01 · Intended use
02 · Current rights evidence
Signed request
asset_74cc · distribution · exp 00:54 Decision now
Distribution refused
Unknown never becomes permission. Add evidence, then try the same URL again.
purpose=distribution · rights=unknown · decision=deny One accountable workflow
A DAM is more than a grid of thumbnails.
Move through the product by the job it must do. The same asset stays explainable from ingest to publication.
Find it
A library that explains every result.
Search, facets, saved views and near-duplicate detection work over the same permission-scoped catalogue.
- Explainable query language
- Hot previews for archived masters
- Perceptual similarity
Product surface
Search
Provenance
Rights
Storage
Automation
Integrations
System map
The original may sleep. The library stays awake.
Metadata, previews and search stay hot while masters move through lower-cost storage. A model upgrade never has to thaw the archive.
01
Ingest
Stream, hash, sniff and scan.
02
Derive
Preview, proxy and evidence.
03
Index
Search only after previews exist.
04
Deliver
Evaluate rights, record, release.
S3-compatible pools
HOTPreviews + search substrateinstant
COOLRecent originalsinstant + fee
ARCHIVEOlder mastersasync restore
Search is a derived cache
PostgreSQL remains the record. Tantivy and vectors can be rebuilt, upgraded or replaced.
Split by failure profile
The API stays latency-sensitive; the worker owns CPU-heavy and untrusted media processing.
Documentation
Read the reason, then run the command.
The repository documents the contract, architectural decisions, deployment shape and unfinished work. Nothing is hidden behind a glossy status page.
Run the full stack locally
mise pins the toolchain. Docker supplies PostgreSQL and SeaweedFS; the API, worker and web app remain separate processes.
mise install
mise run up
mise run dev:seedFind it. Trust it. Use it.