H1K0 945df7ef8a fix(backend): enforce file ACL on file-tag and import endpoints ...

Two broken-access-control holes:

- PUT/DELETE /files/:id/tags(/:tag_id) and GET /files/:id/tags went
  straight to TagService with no ACL check, letting any authenticated
  user read or rewrite tags on anyone's private files. The handlers now
  require view (list) or edit (mutate) on the target file via new
  FileService.AuthorizeView/AuthorizeEdit helpers.

- POST /files/import accepted an arbitrary host path from any user,
  turning it into an arbitrary server-side file read. It is now
  admin-only and the supplied path is confined to IMPORT_PATH.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 13:59:33 +03:00

backend

fix(backend): enforce file ACL on file-tag and import endpoints

2026-06-10 13:59:33 +03:00

docs

docs(project): add reference Python/Flask implementation

2026-04-03 18:36:05 +03:00

frontend

fix(frontend): use $appSettings.tagRuleApplyToExisting on creating a new tag rule also

2026-04-07 11:59:09 +03:00

.env.example

feat(backend): config, migrations embed, and server entrypoint

2026-04-03 18:57:17 +03:00

.gitattributes

chore(project): add .gitignore and .gitattributes

2026-04-03 18:35:22 +03:00

.gitignore

chore(project): add .gitignore and .gitattributes

2026-04-03 18:35:22 +03:00

CLAUDE.md

docs(project): document scoped commit naming convention in CLAUDE.md

2026-04-04 21:41:22 +03:00

openapi.yaml

feat(backend): apply tag rules retroactively to existing files on activation

2026-04-07 00:00:45 +03:00

S

Description

🎋Tanabata — web file manager with tags!

apicfile-managergolangpythonrestapitelegram-botwebapp

5.6 MiB

Languages

Go 50%

Svelte 38.6%

TypeScript 8.8%

PLpgSQL 1.4%

Dockerfile 0.5%

Other 0.7%