Marco Beretta 2c2cea95aa fix: owner-scope referenced file caps and include thread file ids ... Two gaps in the referenced-file-id capping: The file_id branch matched File rows with no ownership check, and file ids inside message/conversation documents are caller-supplied (saveMessage spreads request params into the update). A crafted or imported message referencing another user's file_id would therefore set that user's File.expiredAt during a forced-retention cascade or migration, and the storage sweeper would later delete their object. The referenced-id branch now always filters on File.user (dropped entirely when the caller's user id is not a castable ObjectId string — fail closed), in both capConversationFiles and the bulk tag/project scope. The conversationId branch stays unscoped: those rows are server-created by the conversation's own processes, and an id collision can only shorten the colliding owner's files. Assistants conversations persist thread uploads on Conversation.file_ids (saveUserMessage/syncMessages), which the parent projections never read, so files stored only there kept expiredAt: null after conversion. A shared conversationSeedFileIds helper now seeds the id collection from both files and file_ids across the cascade, saveConvo, the bulk cascade, and both sweep passes.		2026-07-05 04:21:21 +02:00
..
api	fix: enforce ephemeral retention on chat project membership changes	2026-07-03 15:03:09 +02:00
client	🧪 ci: Resolve DataTable test infinite re-render (#13947)	2026-06-24 23:40:18 -04:00
data-provider	feat: add ephemeral retention mode for forced temporary chats	2026-06-30 04:51:45 +02:00
data-schemas	fix: owner-scope referenced file caps and include thread file ids	2026-07-05 04:21:21 +02:00