SnapOtterandGitHub 1544966b52 fix(api): authorize the standalone upload and preview routes (#707) ...

POST /api/v1/upload, POST /api/v1/preview and POST /api/v1/preview/generate
authenticated but never authorized, sitting between requireFileAccess (which
guards /api/v1/files) and toolAccessMiddleware (scoped to /api/v1/tools/). A key
scoped to settings:read alone could still stage bytes behind the unauthenticated
download URL and drive Sharp, libheif, LibRaw and FFmpeg.

Upload now takes requireFileAccess; both preview routes take tools:use.
requireFileAccess moves to permissions.ts so the modules share one definition.

2026-08-01 14:40:09 +08:00

..

fixtures

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

generated

fix(fuzz): bound settings-fuzz inputs, cap split tiles, budget the slow codecs, steady flakes (#696)

2026-07-31 06:56:44 +08:00

platform

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

security

fix(api): authorize the standalone upload and preview routes (#707)

2026-08-01 14:40:09 +08:00

tools

fix(fuzz): bound settings-fuzz inputs, cap split tiles, budget the slow codecs, steady flakes (#696)

2026-07-31 06:56:44 +08:00

pipeline-templates-drift.test.ts

feat: pipeline templates, analytics opt-out, 83 conversion presets, positioning + e2e modernization

2026-06-28 18:57:53 +08:00

settle-job.ts

fix: release QA hardening across processing, media, security, and CI gates (#649)

2026-07-27 15:37:30 +08:00

sign-pdf.test.ts

fix(pdf): stop page tools failing on short and encrypted PDFs (#594)

2026-07-21 06:14:43 +00:00

test-server.ts

fix(api): authorize the standalone upload and preview routes (#707)

2026-08-01 14:40:09 +08:00

tool-route-drift.test.ts

fix(pdf): pdf-to-image presets no longer 404 on 2+ files (#643)

2026-07-26 01:35:42 +08:00