- Shipped
- August 22, 2026 at 10:03 PM UTC
- Author
- Kamo
- Commit
- 361d5f5
Self only, and enforced in the QUERY. Every read and write resolves the member from the session and every repository call takes that id, including the single-frame lookup — a frame id is a UUID that travels to the browser and back, so a findById would hand somebody else's wall to whoever guessed one. There is deliberately no "manage another member's frames" endpoint: an administrator's control over this feature is the right, not the contents. Media goes through ImageService rather than being stored here, which buys content-addressed dedup (the same photo in three frames is one stored file), org storage accounting, and playback through the existing imaging proxy — which already speaks HTTP Range, so a video already seeks. Hashes are computed in the controller because the pipeline validates the caller's against its own and the caller here IS the server; that is what every other server-side uploader in the platform does. A slideshow's ORDER lives in the frame's settings blob, not as a column on each image: an imaging row is shared by every association referencing its bytes, so a sort column on it would belong to whichever frame wrote last. Deleting a frame trashes its media. Leaving the rows behind would keep billing the organization for a wall nobody can open, which is the orphan class this platform has been bitten by before. Ceilings: 12 frames a member, 120 items a frame, 100 MB a file. The last is well under the platform's other upload limits on purpose — this is wall decoration that autoplays behind a launchpad, and a 2 GB video would be fetched by every tab the member opens. The rights seed from MANAGE_OWN_BACKGROUND_IMAGES, which already says this member may decorate their own screen with their own uploads — the safest seed of the lot, since nothing in a frame is anybody else's data. ADDED deliberately does NOT seed, unlike every other widget: the others open on something the member already has and are useful the moment they appear, while an empty picture frame nobody asked for is clutter. Handlers name their session helper currentMember so the unauthenticated endpoint ratchet can see the guard — its scan reads one method body and does not follow calls.