Waleed 2f7d60745a fix(uploads): close multipart storage-quota bypass via quota-exempt contexts (#5155) ...

The multipart endpoint accepted the quota-exempt public-asset contexts
(og-images, profile-pictures, workspace-logos), which skip checkStorageQuota,
letting any authenticated writer open arbitrarily large upload sessions that
never count against their plan limit.

These contexts have no large-file flow: their client hooks hard-cap uploads at
5MB (image-only) and the direct-upload strategy only uses multipart above 50MB,
so they always route through the presigned endpoint. Remove them from
ALLOWED_UPLOAD_CONTEXTS (joining logs) so every context the multipart endpoint
serves is quota-enforced.

2026-06-20 14:07:24 -07:00

..

docs

improvement(access-controls): docs, terminology, fix delete bug (#5141)

2026-06-19 13:48:07 -07:00

realtime

improvement(governance): derived access (#5134)

2026-06-19 12:47:09 -07:00

sim

fix(uploads): close multipart storage-quota bypass via quota-exempt contexts (#5155)

2026-06-20 14:07:24 -07:00