Andrey Antukh 77033af34e 🐛 Scope assemble-chunks session lookup to profile-id ...

Prevent BOLA in chunked upload assembly by verifying session
ownership. The assemble-chunks function now requires a profile-id
parameter and scopes the upload_session lookup accordingly, matching
the pattern already used by upload-chunk.

All three callers (assemble-file-media-object, create-font-variant,
import-binfile) updated to pass the authenticated profile-id.

AI-assisted-by: mimo-v2.5-pro

2026-08-03 16:30:06 +00:00

..

backend_tests

🐛 Scope assemble-chunks session lookup to profile-id

2026-08-03 16:30:06 +00:00