Require permissions before generating asset upload URLs

[timkelty]

Require the appropriate volume permissions before generating presigned asset upload URLs. Resolve replacement uploads against the target asset folder, return not found for unknown targets, and add focused regression coverage.

[Copilot]

Pull request overview

Adds permission checks before generating presigned asset upload URLs while preserving replacement-specific authorization and adding regression coverage.

Changes:

• Enforces saveAssets for standard uploads.
• Retains replacement and peer-volume permission checks.
• Adds denied-upload regression tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Summary	Review status
tests/unit/AssetsControllerTest.php	Adds coverage for denied upload URL generation.	No blocking findings.
src/controllers/AssetsController.php	Adds upload permission validation.	Critical: requests containing both assetId and folderId can authorize the wrong operation, use the wrong upload key, and cause replacement failure.

Suppressed comments (1)

src/controllers/AssetsController.php:75

• The new upload-URL path now has a separate replacement branch that enforces both replaceFiles and replacePeerFiles, but the added regression test only exercises the saveAssets branch. Please add a focused test with an assetId that verifies both replacement permission checks run and prevent presigned URL generation; otherwise this security-sensitive branch can regress without detection.

        if ($assetToReplace) {
            $this->requireVolumePermissionByAsset('replaceFiles', $assetToReplace);
            $this->requirePeerVolumePermissionByAsset('replacePeerFiles', $assetToReplace);

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.