Org-scoped counterparts for the thumbnail-backfill candidate queries

Shipped

September 23, 2026 at 8:56 AM UTC

Author

Kamo

Commit

bde06a3

DocsService's /backfill-thumbnails admin endpoint selected candidates from **************** (platform-wide, no organization predicate) or, as a last resort, a raw findAll filtered in memory — so any org's MANAGE_STORAGE admin could trigger a sweep that read and rewrote every OTHER tenant's document bytes too. Add real, org-scoped, paged equivalents of all three tiers for DocsService to select from instead.