- Ya
- 15 Agosti 2026, 02:58 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 59b2e18
The document rights are enforced in DocsService as of this change, but the upload endpoints are not in DocsService — kamo-internal's app/api/imaging/upload proxies straight to ConversionService. Without these four gates CREATE_DOCUMENTS would be enforced on creating a folder and bypassed by uploading a file, which is not a gate at all, just a longer route to the same place. upload, check-hashes, register-existing and the template upload all take it. check-hashes and register-existing are the dedup and adopt-existing-object halves of the same flow: leaving them open would leave a path to register a document without holding the right to create one. The check reads hasRightApplied, so the answer is whatever the organization's security model resolves to, and it fails closed when the member row is gone. It runs after authentication and before the malware scan. Refusing someone who may not upload costs a rights lookup; scanning first would spend a full scan on a request that was always going to be refused. The malware test now supplies a granting rights service — Mockito's default false would have turned every case into a 403 and stopped it testing the scan guard, which is the thing under test.