25c6843fce
* fix(api): enforce FILE_SIZE_LIMIT on published Space asset upload
The public Space asset upload endpoint
(POST /api/public/assets/v2/anchor/{anchor}/) trusted the client-supplied
`size` value end-to-end: it was stored on the FileAsset and passed straight
to generate_presigned_post(), which uses it as the S3/MinIO policy bound
(["content-length-range", 1, file_size]). This let an authenticated user
obtain a signed upload policy exceeding the instance's FILE_SIZE_LIMIT.
Cap the value with `size_limit = min(size, settings.FILE_SIZE_LIMIT)` and use
it consistently for the stored asset metadata and the presigned POST policy,
matching every other asset upload endpoint.
* fix(api): clamp Space asset size to a valid lower bound
Address review feedback: reject malformed (non-integer) `size` with 400 and
clamp the value to [1, FILE_SIZE_LIMIT] via max(1, min(...)) so the presigned
content-length-range is always valid and no non-positive size is persisted.
|
||
|---|---|---|
| .. | ||
| __init__.py | ||
| asset.py | ||
| base.py | ||
| cycle.py | ||
| intake.py | ||
| issue.py | ||
| label.py | ||
| meta.py | ||
| module.py | ||
| project.py | ||
| state.py | ||