ryan 7b379863b4 fix(upload): restrict cross-user private file access (UPLOAD-1) ...

- Add access_mode column to w_uploads table (0 = private, 1 = public) and initialize data in a single migration script
- Enforce strict ownership check for private files during download
- Allow public files to follow whitelisted public-access rules
- Default access_mode to public for avatars and private for generic uploads
- Update frontend service to support optional accessMode parameter

2026-06-13 10:13:41 +08:00

100 KiB

Raw Blame History