Close data leaks: remove anonymous user creation, hide private playlists, validate uploads and clamp gateway ranges

2026-09-24 05:00:21 +02:00
parent c8fe28b07b
commit c8e9c7790e
34 changed files with 374 additions and 553 deletions
@@ -37,6 +37,7 @@ public sealed class UploadIntentValidator(
        UploadIntentConfiguration config,
        Guid intentId,
        long userId,
+        UploadIntentPurpose purpose,
        CancellationToken cancellationToken)
    {
        var intent = await database.UploadIntents
@@ -45,6 +46,9 @@ public sealed class UploadIntentValidator(
        if (intent == null || intent.UserId != userId)
            return Error.NotFound(description: "Upload intent not found or not accessible.");

+        if (intent.Purpose != purpose)
+            return Error.Validation(description: "Upload intent was issued for a different purpose.");
+
        if (intent.IsConsumed)
            return Error.Conflict(description: "Upload intent has already been consumed.");