Hand a client a file library, not an FTP login

Total CMS has two upload fields. A file field holds one upload — a spec sheet, a signed contract, a single PDF. A depot field holds as many as the record needs, and it is where a site keeps the things it hands out: manuals, price lists, session recordings, a year of invoices.

Both are fields on a schema, so the files belong to a record rather than to a shared drop box somewhere on the server. The upload rules live in the schema next to the field, and they are enforced before anything reaches disk:

• size — minimum and maximum in kilobytes
• count — how many files a depot may hold
• filetype — an allow-list of MIME types
• filename — an allow-list of exact names, for a record that expects one specific document

Access is decided by the collection, not by where a file happens to sit on disk. New uploads are protected by default, which means they inherit the collection's File Access Groups: leave that list empty and the file is effectively public; set it to default and any signed-in user can download it; name groups and only members of those groups can. Set protectedByCollection to false on a field whose files are meant to be open — a downloads page, marketing assets — and new uploads land unprotected instead. Existing files keep whatever setting they already had.

In a template you never build a path. cms.media.depot() lists the files on a property, cms.media.depotDownload() returns a URL that sends one as an attachment, and cms.media.depotStream() returns one that plays inline and answers HTTP range requests — which is what a video scrubber needs to work. Both accept a subfolder path and an optional password.

The shape this takes in practice: a consultancy keeps one record per client with a depot of deliverables filed by year. The client signs in and sees their own record's files and nobody else's, and the consultant adds next quarter's report by dropping it into the right subfolder in the admin.