Can you add that this is a private function that assume that ctx, principal and file have already been validated?