Repository navigation
feat(file-manager): list file metadata by type and permissions - #124
Merged
Merged
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
Author
|
Codex Review: Didn't find any major issues. 👍 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
GET /api/v1/filesto list stored metadata with pagination and sorting. The filter contains optionalType,SearchandUserId. Return ID, name, type, upload status, content type and size without inspecting S3.Keep permission rules in one private
FileAccessPolicy.CanRead(type, userId)predicate. Both aggregate and filter checks delegate to it.ApplyReadRestrictionschecks the filter and, only after a denial with no supplied owner, retries with the current user's ID. An explicitly supplied owner is never replaced. Type is never supplied automatically or rewritten.Omitting Type requests both Personal and Avatar files, so CanRead requires permission for the entire selection. An own-only Personal caller with Avatar read permission can omit UserId; the policy supplies the current owner. A caller permitted to read only one file type must select that Type explicitly; otherwise the request returns 403. Personal
read.allaccepts an optional owner and takes precedence overread.own. Explicit foreign owners with only own permissions return 403. Owner criteria apply only to Personal rows.Input validation remains in
FilesFilterValidatorand the query validator, using Core Application 5.4.2 domain-factory validation with paths such asFilter.TypeandFilter.UserId. Invalid HTTP filters return 400, missing authentication/user account returns 401 and denied access returns 403.The handler passes the policy's resulting filter to the read repository. The repository depends only on the read DbContext and uses a private
ApplyFilterto build type, Personal owner and name predicates before counting or paging. Preserve Core's soft-delete filter and deterministic Name/ID sorting. Type/name whitespace is handled when applying SQL criteria. The repository performs no policy or permission checks.Validation: