J3vbandClaude Fable 5 4b37c8024e fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3) ...

The per-attachment GetAttachmentByID pre-check loop was a check-then-link
TOCTOU (the same race pattern this branch fixes elsewhere), an N+1 on the
hot send path, and a hard ErrForbidden for legit retries naming an
already-linked attachment. Ownership now lives in the one UPDATE that
links: `AND message_id IS NULL AND (uploader_id = ? OR uploader_id IS
NULL)` — a foreign attachment can never be claimed, legacy NULL-uploader
rows stay claimable, and skipped rows (foreign/linked/missing) are logged
but never fail the send, so retries can't hard-fail. Subsumes W2-4; the
MemStore (nil,nil) GetAttachmentByID contortion is replaced by a real
map-backed attachment store so the guard is testable (W3-5).

Companion commit updates test callsites and adds ownership coverage.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-19 08:29:26 +02:00

..

memstore_events.go

fix(phase-bc): address review findings — auth, SSRF, seq alignment

2026-04-06 09:29:29 +00:00

memstore.go

fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3)

2026-07-19 08:29:26 +02:00

sqlite_events.go

fix(server): resolve golangci-lint contextcheck, errcheck, gocritic findings

2026-04-07 09:10:14 +02:00

sqlite.go

fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3)

2026-07-19 08:29:26 +02:00

store.go

fix(service): enforce attachment ownership atomically in the link UPDATE (W1-3)

2026-07-19 08:29:26 +02:00