Files
BillyOutlastandClaude Opus 5.5 38fce1a07d Patch 07: refuse attachment uploads in BYOK mode (audit A2)
Upstream added chat attachments after the fork diverged, so the forward-
ported Generation.js had no BYOK branch for them: with a custom endpoint
enabled, a logged-in user's attachment was still uploaded to GDevelop's
storage (logged out, the UI already refuses before uploading).

- createAiAttachmentUploads throws before any hosted call when the custom
  endpoint is enabled or the user is local-* — the same rule the presigned
  project-JSON upload already uses. The caller turns it into the existing
  'upload failed' chip.
- createAiAttachmentDownloads returns not-found entries for a local-* user.
  Attachments of a hosted chat are hosted data and are still read there.

Patch 07 was re-derived, not hand-edited: a plain diff -U3 of pristine vs
patched reproduces the previous patch byte-for-byte, and the new one
differs from it only by these two insertions (minus-line count unchanged
at 66). The contract test asserted the gap; it now asserts the guards
(red before, green after). REBASE.md records these as post-fork additions
and switches the rebase recipe to use our own patched file as the third
side, since the donor is retired.

Not verified live: reaching the guard needs a logged-in session.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-11 16:28:38 -04:00
..