keith/MeshVault
1
0 Fork 0
Code Issues 44 Pull Requests Actions Packages Projects Releases Wiki Activity

Safe model file download and serving #33

New Issue
Open
opened 2026-10-10 22:22:01 +00:00 by keith · 0 comments
keith commented 2026-10-10 22:22:01 +00:00
Owner
Copy link
Copy source

Context

Implement this MVP work package under M4 - Catalog Core, following the managed-storage decision in #1.

Acceptance criteria

  • Resolve downloads by file ID within managed root, never arbitrary request paths.
  • Stream large downloads with safe Content-Disposition and MIME types; supplementary content cannot execute.
  • Missing files produce useful status; test traversal, symlinks and large files.

Blocked by: #28

## Context Implement this MVP work package under M4 - Catalog Core, following the managed-storage decision in #1. ## Acceptance criteria - [ ] Resolve downloads by file ID within managed root, never arbitrary request paths. - [ ] Stream large downloads with safe Content-Disposition and MIME types; supplementary content cannot execute. - [ ] Missing files produce useful status; test traversal, symlinks and large files. Blocked by: #28
keith added this to the M4 - Catalog Core milestone 2026-10-10 22:22:01 +00:00
keith added the type:featurepriority:mediumarea:backend labels 2026-10-10 22:22:01 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Labels
Clear labels
area:backend
PHP application logic
 area:db
PostgreSQL schema and migrations
 area:frontend
PHP views, Tailwind, browser JS
 area:indexer
Scanning, hashing, import pipeline
 area:infra
Docker, CI, deployment
 priority:high
Blocking or critical path
 priority:low
Nice to have
 priority:medium
Normal priority
 type:bug
Defect
 type:chore
Tooling, scaffolding, maintenance
 type:decision
Architecture decision record
 type:docs
Documentation
 type:feature
New user-facing capability
No labels area:backend priority:medium type:feature
Milestone
No items
No Milestone M4 - Catalog Core
Projects
Clear projects
No projects
Assignees
Clear assignees
keith (Keith Solomon)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: keith/MeshVault#33