SnapOtterandGitHub 577d74bdb1 fix(api): enforce job ownership on cancel endpoint (#599) ...

The job cancel endpoint authenticated the caller but never checked that the job belonged to them, so any authenticated user could cancel another user's job by ID. Load the job's owner and allow cancellation only for the owner or a caller with files:all; return 404 for missing and non-owned jobs alike. Extract the route into a shared registerJobRoutes() so the ownership check is covered by tests.

Reported by Alpesh Bhagwatkar.

2026-07-21 15:09:00 +08:00

..

fixtures

fix(compress-pdf): land close to the target size, honestly (#522)

2026-07-16 15:08:21 +08:00

generated

fix(audio): expose sample rate setting in Convert Audio (#561)

2026-07-18 10:14:50 +08:00

platform

fix(api): enforce job ownership on cancel endpoint (#599)

2026-07-21 15:09:00 +08:00

security

fix: make OCR portable and reliable across AMD64 and ARM64 (#519)

2026-07-15 03:34:24 +08:00

tools

fix(pdf): stop page tools failing on short and encrypted PDFs (#594)

2026-07-21 06:14:43 +00:00

pipeline-templates-drift.test.ts

feat: pipeline templates, analytics opt-out, 83 conversion presets, positioning + e2e modernization

2026-06-28 18:57:53 +08:00

settle-job.ts

fix: make OCR portable and reliable across AMD64 and ARM64 (#519)

2026-07-15 03:34:24 +08:00

sign-pdf.test.ts

fix(pdf): stop page tools failing on short and encrypted PDFs (#594)

2026-07-21 06:14:43 +00:00

test-server.ts

fix(api): enforce job ownership on cancel endpoint (#599)

2026-07-21 15:09:00 +08:00

tool-route-drift.test.ts

fix: make OCR portable and reliable across AMD64 and ARM64 (#519)

2026-07-15 03:34:24 +08:00