fix(accounts): bind media routes to account incarnation - #457
fix(accounts): bind media routes to account incarnation#457veryCrunchy wants to merge 2 commits into
Conversation
Obiente previewNC Native · Obiente updates this comment as the preview changes. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
veryCrunchy
changed the title
97516f7 to
22e7218
Compare
8402deb to
09f3f38
Compare
09f3f38 to
412da29
Compare
412da29 to
3a46d39
Compare
…oute-account-ownership
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: fbc82c3783
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| platforms: android, desktop | ||
| user-facing: yes | ||
|
|
||
| Media viewer routes now stay bound to the account and account incarnation that created them, preventing stale media from opening after an account is removed or replaced. |
There was a problem hiding this comment.
When credentials for an existing NextcloudAccountId are replaced in place, neither platform retires the shared account-memory gate: Android's AndroidDynamicAccountActivation.afterCredentialSave and desktop's saveSession only reactivate it. Meanwhile, MediaViewerNavigationRepository.RouteContent stores only the account ID and resolve uses the storage-key-only gate.read, so a route created under the previous credential incarnation remains resolvable. Either bind routes to a captured producer/incarnation and test credential replacement, or remove the unsupported replacement guarantee from this release-facing fragment.
AGENTS.md reference: AGENTS.md:L106-L108
Useful? React with 👍 / 👎.
| @@ -0,0 +1,7 @@ | |||
| category: fix | |||
There was a problem hiding this comment.
For the account-removal case that is implemented, preventing private media retained from a removed account from reopening is a user-facing confidentiality fix. The fragment rules in changes/README.md explicitly reserve security for user-facing confidentiality fixes, but this metadata causes the generated changelog and release notes to place the change under ordinary Fixes instead of Security; set category: security so the release record discloses the boundary correctly.
AGENTS.md reference: AGENTS.md:L109-L111
Useful? React with 👍 / 👎.
1 participant
Outcome
Bind media viewer routes to the account identity and account incarnation that created them. Stale media navigation can no longer reopen content after the owning account is removed or replaced.
Verification
git diff --checkbash tools/check-repository.shchanges/unreleased/media-route-account-ownership.mdCompatibility and risk
Android and desktop media navigation state are affected. No media bytes, persisted server data, or DAV contracts change. This PR is stacked on #456.
Visual changes
Not applicable.