Danny Avila ad08df4db6 🔏 fix: Scope Agent-Author File Access to Attached Files Only (#12251) ... * 🛡️ fix: Scope agent-author file access to attached files only The hasAccessToFilesViaAgent helper short-circuited for agent authors, granting access to all requested file IDs without verifying they were attached to the agent's tool_resources. This enabled an IDOR where any agent author could delete arbitrary files by supplying their agent_id alongside unrelated file IDs. Now both the author and non-author paths check file IDs against the agent's tool_resources before granting access. * chore: Use Object.values/for...of and add JSDoc in getAttachedFileIds * test: Add boundary cases for agent file access authorization - Agent with no tool_resources denies all access (fail-closed) - Files across multiple resource types are all reachable - Author + isDelete: true still scopes to attached files only		2026-03-15 18:54:34 -04:00
..
Action.js	🛡️ refactor: Scope Action Mutations by Parent Resource Ownership (#12237)	2026-03-15 10:19:29 -04:00
Action.spec.js	🛡️ refactor: Scope Action Mutations by Parent Resource Ownership (#12237)	2026-03-15 10:19:29 -04:00
Agent.js	🛸 feat: Remote Agent Access with External API Support (#11503)	2026-01-28 17:44:33 -05:00
Agent.spec.js	🔧 fix: Agent Deletion Logic to Update User Favorites (#11466)	2026-01-21 15:01:04 -05:00
Assistant.js	🏗️ refactor: Extract DB layers to data-schemas for shared use (#7650)	2025-05-30 22:18:13 -04:00
balanceMethods.js	🛜 refactor: Streamline App Config Usage (#9234)	2025-08-26 12:10:18 -04:00
Banner.js	🏗️ refactor: Extract DB layers to data-schemas for shared use (#7650)	2025-05-30 22:18:13 -04:00
Categories.js	🧹 chore: Cleanup Logger and Utility Imports (#9935)	2025-10-01 23:30:47 -04:00
Conversation.js	🔐 fix: Add User Filter to Message Deletion (#12220)	2026-03-13 23:42:37 -04:00
Conversation.spec.js	🔐 fix: Add User Filter to Message Deletion (#12220)	2026-03-13 23:42:37 -04:00
ConversationTag.js	🏷️ fix: Increment Tag Counters When Forking/Duplicating Conversations (#9737)	2025-09-19 22:02:09 -04:00
convoStructure.spec.js	🐛 fix: String Interpolation in Messages Endpoint from #9155 (#9312)	2025-08-27 13:48:48 -04:00
File.js	🗂️ feat: Better Persistence for Code Execution Files Between Sessions (#11362)	2026-01-28 17:44:32 -05:00
File.spec.js	🔏 fix: Scope Agent-Author File Access to Attached Files Only (#12251)	2026-03-15 18:54:34 -04:00
index.js	🧵 refactor: Migrate Endpoint Initialization to TypeScript (#10794)	2025-12-11 16:37:16 -05:00
interface.js	🛜 refactor: Streamline App Config Usage (#9234)	2025-08-26 12:10:18 -04:00
inviteUser.js	🧵 refactor: Migrate Endpoint Initialization to TypeScript (#10794)	2025-12-11 16:37:16 -05:00
loadAddedAgent.js	🛡️ fix: Enforce MULTI_CONVO and agent ACL checks on addedConvo (#12243)	2026-03-15 17:12:45 -04:00
Message.js	🗑️ fix: Remove All User Metadata on Deletion (#10534)	2025-11-21 12:03:26 -05:00
Message.spec.js	🔧 fix: Sorting and Pagination logic for Conversations (#11242)	2026-01-07 09:44:45 -05:00
Preset.js	🏗️ refactor: Extract DB layers to data-schemas for shared use (#7650)	2025-05-30 22:18:13 -04:00
Project.js	🏗️ refactor: Extract DB layers to data-schemas for shared use (#7650)	2025-05-30 22:18:13 -04:00
Prompt.js	⚡ refactor: Optimize & Standardize Tokenizer Usage (#10777)	2025-12-02 12:22:04 -05:00
Prompt.spec.js	🛂 feat: Role as Permission Principal Type	2025-08-13 16:24:23 -04:00
PromptGroupMigration.spec.js	🔧 refactor: Integrate PrincipalModel Enum for Principal Handling	2025-08-13 16:24:22 -04:00
Role.js	🧬 fix: Backfill Missing SHARE Permissions and Migrate Legacy SHARED_GLOBAL Fields (#11854)	2026-02-18 12:48:33 -05:00
Role.spec.js	🧬 fix: Backfill Missing SHARE Permissions and Migrate Legacy SHARED_GLOBAL Fields (#11854)	2026-02-18 12:48:33 -05:00
spendTokens.js	🤖 feat: Claude Opus 4.6 - 1M Context, Premium Pricing, Adaptive Thinking (#11670)	2026-02-06 18:35:36 -05:00
spendTokens.spec.js	🤖 feat: Gemini 3.1 Pricing and Context Window (#11884)	2026-02-20 16:21:32 -05:00
ToolCall.js	🏗️ refactor: Extract DB layers to data-schemas for shared use (#7650)	2025-05-30 22:18:13 -04:00
Transaction.js	🧮 refactor: Bulk Transactions & Balance Updates for Token Spending (#11996)	2026-03-01 12:26:36 -05:00
Transaction.spec.js	🧮 refactor: Bulk Transactions & Balance Updates for Token Spending (#11996)	2026-03-01 12:26:36 -05:00
tx.js	🤖 feat: GPT-5.4 and GPT-5.4-pro Context + Pricing (#12099)	2026-03-06 02:11:01 -05:00
tx.spec.js	🤖 feat: GPT-5.4 and GPT-5.4-pro Context + Pricing (#12099)	2026-03-06 02:11:01 -05:00
userMethods.js	🛜 refactor: Streamline App Config Usage (#9234)	2025-08-26 12:10:18 -04:00