Hyeonsang Cho 5f72f28988
fix(projects): check the project before staging shelf uploads (#7040)
* fix(projects): check the project before staging shelf uploads

The shelf upload and save-from-thread routes staged the body under
users/{user_id}/projects/{project_id}/ before checking the project. A
missing, foreign, or archived id left an empty {project_id}/documents/
directory that the retention sweep keeps forever, and an id longer than
one path component failed with ENAMETOOLONG (500).

Both routes now require an owned, active project first and answer the
same 404 without writing. The shelf insert still re-checks under the
project row lock.

* test(projects): pin the shelf insert's re-check behind the early project check

With the early check in place, no route test reached the insert's
row-lock re-check any more. Archive the project between the check and
the insert and assert both routes still answer 404 and leave no staging
file.

* docs(changelog): reference #7040 for the shelf upload project check

* docs(changelog): drop the whitespace-only line after the zh #7040 entry

---------

Co-authored-by: Willem Jiang <willem.jiang@gmail.com>
2026-10-19 15:46:42 +08:00
..