There should be two attachment types - private and public. Public attachments are accessible from non-expiring URLs and private attachments are accessible through the following configurable options
- PAT with correct permissions (AKA downloadable via stream...not just a link)
- Expiring URLs that optionally require login to view and have configurable expiration times
- Online from a properly permissioned user account