Skip to content

fix(hub): refuse a read of an attachment the person removed - #188

Merged
TheGreatAxios merged 1 commit into
mainfrom
cl-12153-refuse-a-read-of-an-attachment-the-person-removed
Nov 5, 2026
Merged

TheGreatAxios merged 1 commit into
mainfrom
cl-12153-refuse-a-read-of-an-attachment-the-person-removed

Conversation

@TheGreatAxios

Copy link
Copy Markdown
Contributor

The artifact service's read now answers artifact_not_found for an archived row. Removing an attachment archives it; lists already left it out, but a read by id still returned its content. Every read by id (the artifact route, read_artifact, pinned id@v#sha) goes through this check. Only removeMaterial archives artifacts, so no other kind is affected.

Fixes CL-12153.

Verification

A throwaway end-to-end run against the real hub on a scratch Postgres, which imported a project with two materials and removed one:

Before After
Read the removed material by id 200 with its content 404
Read the kept material 200 200
Material list hides the removed one hides the removed one

bun run lint, format:check, typecheck and test (290 pass) pass.

@linear-code

linear-code Bot commented Nov 5, 2026

Copy link
Copy Markdown

CL-12153

@corbits-triage corbits-triage Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No defects reported.

@TheGreatAxios
TheGreatAxios marked this pull request as ready for review November 5, 2026 02:36
@corbits-triage

corbits-triage Bot commented Nov 5, 2026 •

Copy link
Copy Markdown

Merged before Triage finished on 686e6cb.

corbits-triage[bot]
corbits-triage Bot previously approved these changes Nov 5, 2026
Removing an attachment archives it, and lists already leave it out, but a read by id still returned its content. A coordinator that kept the id from an earlier read could still quote the withdrawn file. A removed attachment now reads as not found, the same as a missing one.
@TheGreatAxios
TheGreatAxios force-pushed the cl-12153-refuse-a-read-of-an-attachment-the-person-removed branch from 4471acb to 686e6cb Compare November 5, 2026 02:39
@TheGreatAxios
TheGreatAxios merged commit dc3dde9 into main Nov 5, 2026
9 checks passed
@TheGreatAxios
TheGreatAxios deleted the cl-12153-refuse-a-read-of-an-attachment-the-person-removed branch November 5, 2026 02:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant