- Ya
- 3 Agosti 2026, 02:35 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 3db7aa9
/download already logged through **************** and it was the platform's only byte-access injection site. The sibling endpoints serving the exact same bytes — /stream, /bulk-download, the template converted-PDF and the template page thumbnail — recorded nothing, so anyone wanting document bytes without leaving a trace only had to pick a different URL. All four now emit a PhiAccessEvent at the point access has been verified and the bytes are about to be served. Bulk download emits one event per document rather than one per request. "They exported 400 documents" is not an answer to "was this individual's record disclosed", and per-document rows are what make that answerable six years later under §164.528. Client IP comes from X-Forwarded-For with remoteAddr as fallback: every request arrives through Traefik, so remoteAddr alone would record the ingress pod for every access and be worthless for detection. An unauthenticated attempt is attributed to a sentinel organization rather than dropped — the recorder rejects unattributable events, and a request for document bytes with no session is exactly the event worth keeping. This sits alongside the existing ImgLogDownload rows rather than replacing them: those are imaging-domain records, this is the cross-surface trail an accounting of disclosures is assembled from. Note ImgLogService, which reads those rows, still has zero callers anywhere in the platform.