SnapOtter

External/SnapOtter

Fork 0

mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00

Files

T

History

SnapOtterandGitHub 1544966b52 fix(api): authorize the standalone upload and preview routes (#707 )

POST /api/v1/upload, POST /api/v1/preview and POST /api/v1/preview/generate
authenticated but never authorized, sitting between requireFileAccess (which
guards /api/v1/files) and toolAccessMiddleware (scoped to /api/v1/tools/). A key
scoped to settings:read alone could still stage bytes behind the unauthenticated
download URL and drive Sharp, libheif, LibRaw and FFmpeg.

Upload now takes requireFileAccess; both preview routes take tools:use.
requireFileAccess moves to permissions.ts so the modules share one definition.

2026-08-01 14:40:09 +08:00

adversarial-comprehensive.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649 )

2026-07-27 15:37:30 +08:00

adversarial-coverage-gaps.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649 )

2026-07-27 15:37:30 +08:00

adversarial-extended.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649 )

2026-07-27 15:37:30 +08:00

adversarial-final-gaps.test.ts

fix: release QA hardening across processing, media, security, and CI gates (#649 )