Files
simbarag/tests
ryan 6f093e3f6f Only presign and accept images in the caller's own conversations
GET /api/conversation/image/<key> presigned any S3 key for any logged-in
user, and /upload-image wrote into whatever conversation_id the form named.
Both now require the conversation in the key (or form) to belong to the
caller and return 404 otherwise.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-12 23:18:41 -04:00
..