- Shipped
- September 23, 2026 at 3:11 AM UTC
- Author
- Kamo
- Commit
- bcade53
**************** applied the issued-document check but not the per-party (ACCOUNT_MEMBER_VAULT/LOAN) or trashed-row checks that /download, /stream and the sibling /templates/{imgId}/thumbnail endpoint all apply to the same document bytes — an MLOS per-party vault/loan document's converted PDF (or a trashed document's) was reachable through this one path even though the same bytes are refused everywhere else. Also missing the media-association check (chat/voicemail/call-recording) this branch's finding #2 fix added to the other four byte paths. **************** resolved its source via getDocumentMetadata (org+clearance) only, so a per-party MLOS document or a colleague's HR-issued executed package could be branched into a fresh, ordinary-shaped template id carrying NONE of the source's restriction — an escape hatch around both rules via one extra step. Refused now with the same two checks ImagingController already applies to the generic byte paths, via a new small shared PerPartyAssocRule (previously a private static method only ImagingController could call) and the existing LegalIssuedDocumentAccess (now also injected into DocumentBranchService). /metadata/{imgId} and /list did not filter per-party documents at all — a per-party doc's filename and description (a disclosure on its own, same reasoning /shares/create already applies to issued packages) were readable by any cleared org member, and it appeared in listings. Both now exclude per-party documents unconditionally: unlike the chat/voicemail/call-recording media-association types (finding #2), there is no legitimate generic-imaging caller for a per-party document at all — MLOS access is per-party, at a layer the generic imaging surface has no notion of — so /list drops it even when a caller explicitly requests assocType=LOAN, rather than the "caller explicitly asked, so filter per-row instead of excluding" carve-out media-association types get. New tests: 5 cases in ImagingControllerMediaAssocTest (/list per-party exclusion, /metadata per-party refusal, /templates/converted-pdf per-party, trashed and media-association refusals) and 4 in DocumentBranchServiceTest (per-party vault, per-party loan, a colleague's issued package, and the subject's own issued package still branching successfully). Mutation-checked: reverting ImagingController.java and DocumentBranchService.java to origin/main breaks the build outright (DocumentBranchService's new constructor argument is required) — checked by reverting each file, confirming 4 new DocumentBranchServiceTest cases fail to compile against the reverted constructor, then (with DocumentBranchService restored alone) confirming all 5 new ImagingControllerMediaAssocTest cases go red against the reverted ImagingController.java. Full suite: 767 tests green (was 758; +9 new).