- Ya
- 6 Julai 2026, 16:39 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 1eb3b53
getDocumentMetadata (used by the stream + bulk-download byte paths) does not filter trashed rows the way downloadDocument does, and a soft delete leaves the MinIO object in place — so a trashed vault SSN card / rejected tax return kept streaming its original bytes even though /download correctly returned 'not active'. Guard both byte paths with the same isActive check (a PII-retention / right-to-delete gap). getDocumentMetadata itself still returns trashed rows for the legitimate trash-view/restore/list callers.