- Shipped
- 6 ஜூலை, 2026 அன்று 4:39 PM UTC
- Author
- Kamo
- Commit
- 1eb3b53
getDocumentMetadata (used by the stream + bulk-download byte paths) does not filter trashed rows the way downloadDocument does, and a soft delete leaves the MinIO object in place — so a trashed vault SSN card / rejected tax return kept streaming its original bytes even though /download correctly returned 'not active'. Guard both byte paths with the same isActive check (a PII-retention / right-to-delete gap). getDocumentMetadata itself still returns trashed rows for the legitimate trash-view/restore/list callers.