ryan/simbarag
1
0
Fork 0
Code Issues Pull Requests 4 Actions Packages Projects Releases Wiki Activity

Only presign and accept images in the caller's own conversations #81

Merged
ryan merged 1 commits from fix/image-ownership into main 2026-10-13 07:53:05 -04:00
Conversation 0 Commits 1 Files Changed 2
+61

1 Commits

Author SHA1 Message Date
Ryan Chen 6f093e3f6f Only presign and accept images in the caller's own conversations 
GET /api/conversation/image/<key> presigned any S3 key for any logged-in
user, and /upload-image wrote into whatever conversation_id the form named.
Both now require the conversation in the key (or form) to belong to the
caller and return 404 otherwise.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
 2026-10-12 23:18:41 -04:00