Andrey Antukh 367e4d534c

🐛 Scope assemble-chunks session lookup to profile-id (#11012) ...

Prevent BOLA in chunked upload assembly by verifying session
ownership. The assemble-chunks function now requires a profile-id
parameter and scopes the upload_session lookup accordingly, matching
the pattern already used by upload-chunk.

All three callers (assemble-file-media-object, create-font-variant,
import-binfile) updated to pass the authenticated profile-id.

AI-assisted-by: mimo-v2.5-pro

2026-08-18 14:36:29 +02:00

..

backend_tests

🐛 Scope assemble-chunks session lookup to profile-id (#11012)

2026-08-18 14:36:29 +02:00

e2e

✨ Add Node.js E2E API tests for backend (#10787)

2026-08-05 10:15:41 +02:00