J3vbandClaude Fable 5 4b37c8024e fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3) ...

The per-attachment GetAttachmentByID pre-check loop was a check-then-link
TOCTOU (the same race pattern this branch fixes elsewhere), an N+1 on the
hot send path, and a hard ErrForbidden for legit retries naming an
already-linked attachment. Ownership now lives in the one UPDATE that
links: `AND message_id IS NULL AND (uploader_id = ? OR uploader_id IS
NULL)` — a foreign attachment can never be claimed, legacy NULL-uploader
rows stay claimable, and skipped rows (foreign/linked/missing) are logged
but never fail the send, so retries can't hard-fail. Subsumes W2-4; the
MemStore (nil,nil) GetAttachmentByID contortion is replaced by a real
map-backed attachment store so the guard is testable (W3-5).

Companion commit updates test callsites and adds ownership coverage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 08:29:26 +02:00

..

dbgen

chore(db): commit stale sqlc output; make sqlc-verify honest

2026-07-18 11:45:30 +02:00

queries/sqlite

chore(server): delete unfinished Postgres scaffolding

2026-07-19 08:15:58 +02:00

account_test.go

test: add server core test coverage (Session 1)

2026-04-01 08:41:09 +02:00

account.go

fix: resolve 24 critical and high issues from full code & security review

2026-04-01 09:23:17 +02:00

admin_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

admin_queries.go

fix: resolve 24 critical and high issues from full code & security review

2026-04-01 09:23:17 +02:00

attachment_queries_test.go

fix: resolve 1 critical and 5 high security/reliability issues from go-review

2026-03-19 03:53:40 +01:00

attachment_queries.go

fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3)

2026-07-19 08:29:26 +02:00

auth_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

auth_queries.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

backup_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

block_queries.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

channel_queries_test.go

test: boost server test coverage to 80%+ across all packages

2026-03-18 05:03:38 +01:00

channel_queries.go

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

coverage_boost_test.go

fix: require auth + channel ACL on file serving (BUG-092)

2026-04-02 11:16:16 +02:00

db_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

db.go

refactor: context propagation, LogAudit deadlock fix, ESLint v9, code quality

2026-03-29 19:39:46 +02:00

dm_queries_test.go

feat: comprehensive spec docs, test suite, E2E overhaul, and security hardening

2026-03-28 10:39:23 +01:00

dm_queries.go

chore: remaining server changes (code quality, go mod tidy)

2026-04-01 11:38:33 +02:00

errors_test.go

test: add server core test coverage (Session 1)

2026-04-01 08:41:09 +02:00

errors.go

fix: atomic invite registration, fail-closed search, proxy-aware rate limiting

2026-03-29 19:39:22 +02:00

invite_queries.go

fix: comprehensive security hardening from full codebase audit

2026-04-04 16:48:57 +00:00

lockout_queries.go

fix: security hardening — 11 findings across auth, WS, upload, admin, data

2026-04-02 14:51:16 +02:00

main_test.go

feat: add syncutil mutex, test scaffolding, and server hardening

2026-04-01 12:04:15 +02:00

message_queries_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

message_queries.go

fix: resolve 4 server bugs (Phase 1: BUG-085, BUG-087, BUG-090, BUG-091)

2026-04-01 17:52:06 +02:00

migrate_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

migrate.go

fix: handle BEGIN...END blocks in SQL migration splitter

2026-04-01 15:35:50 +02:00

models_test.go

test: boost server coverage — auth 60→95%, db 69→81%, config 75→85%

2026-04-01 11:38:11 +02:00

models.go

fix: security hardening — 11 findings across auth, WS, upload, admin, data

2026-04-02 14:51:16 +02:00

persisted_event.go

feat: scaffold Phase B + C (events, telemetry, plugins, Solid.js)

2026-04-06 09:00:47 +00:00

profile_queries_test.go

feat: add user profile management endpoints (T-195)

2026-04-01 11:37:55 +02:00

profile_queries.go

feat: add user profile management endpoints (T-195)

2026-04-01 11:37:55 +02:00

role_invite_queries_test.go

fix: resolve CI lint and ESLint failures

2026-04-05 19:37:00 +02:00

role_queries.go

refactor: migrate WS handlers to V2 Command/Event architecture

2026-04-05 19:03:22 +02:00

sanitize_test.go

fix: resolve 4 server bugs (Phase 1: BUG-085, BUG-087, BUG-090, BUG-091)

2026-04-01 17:52:06 +02:00

voice_queries_test.go

feat: LiveKit video grid improvements, voice state cleanup, and internal tooling

2026-03-31 11:41:59 +02:00

voice_queries.go

fix: resolve 24 critical and high issues from full code & security review

2026-04-01 09:23:17 +02:00