Skip to content

fix(accounts): bind media routes to account incarnation #457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
veryCrunchy wants to merge 2 commits into from
Open

fix(accounts): bind media routes to account incarnation #457

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3a46d39
docs(changelog): record media route ownership
veryCrunchy Sep 6, 2026
fbc82c3
Merge branch 'fix/private-memory-account-retirement' into fix/media-r…
veryCrunchy Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 7 additions & 0 deletions changes/unreleased/media-route-account-ownership.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
category: fix

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Classify this confidentiality fix as security

For the account-removal case that is implemented, preventing private media retained from a removed account from reopening is a user-facing confidentiality fix. The fragment rules in changes/README.md explicitly reserve security for user-facing confidentiality fixes, but this metadata causes the generated changelog and release notes to place the change under ordinary Fixes instead of Security; set category: security so the release record discloses the boundary correctly.

AGENTS.md reference: AGENTS.md:L109-L111

Useful? React with 👍 / 👎.

issue: 172
pull: none
platforms: android, desktop
user-facing: yes

Media viewer routes now stay bound to the account and account incarnation that created them, preventing stale media from opening after an account is removed or replaced.

@chatgpt-codex-connector chatgpt-codex-connector Bot Sep 9, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Do not announce incarnation binding before implementing it

When credentials for an existing NextcloudAccountId are replaced in place, neither platform retires the shared account-memory gate: Android's AndroidDynamicAccountActivation.afterCredentialSave and desktop's saveSession only reactivate it. Meanwhile, MediaViewerNavigationRepository.RouteContent stores only the account ID and resolve uses the storage-key-only gate.read, so a route created under the previous credential incarnation remains resolvable. Either bind routes to a captured producer/incarnation and test credential replacement, or remove the unsupported replacement guarantee from this release-facing fragment.

AGENTS.md reference: AGENTS.md:L106-L108

Useful? React with 👍 / 👎.

Loading