Skip to content

fix: add authorization handling to file deletion endpoint - #6528

Merged
wxg0103 merged 1 commit into
v2from
pr@v2@fix_file_deletion_permission
Jul 28, 2026
Merged

fix: add authorization handling to file deletion endpoint#6528
wxg0103 merged 1 commit into
v2from
pr@v2@fix_file_deletion_permission

Conversation

@shaohuzhang1

Copy link
Copy Markdown
Contributor

fix: add authorization handling to file deletion endpoint

Copilot AI review requested due to automatic review settings July 28, 2026 08:53
@shaohuzhang1

Copy link
Copy Markdown
Contributor Author

Seems you are using me but didn't get OPENAI_API_KEY seted in Variables/Secrets for this repo. you could follow readme for more information

@wxg0103
wxg0103 merged commit 4f98d45 into v2 Jul 28, 2026
5 of 7 checks passed
@wxg0103
wxg0103 deleted the pr@v2@fix_file_deletion_permission branch July 28, 2026 08:54

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR tightens access control around OSS file deletion by reusing the existing file-access authorization logic (mk_file_auth / auth()), aligning delete behavior with the file retrieval path that already enforces file-token-based authorization.

Changes:

  • Pass mk_file_auth (and Range) from the delete view into FileSerializer.Operate.delete(...).
  • Update FileSerializer.Operate.delete(...) to call auth(file, mk_file_auth) before deleting the file.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
apps/oss/views/file.py Updates the file deletion endpoint to forward mk_file_auth (and Range) into the serializer deletion call.
apps/oss/serializers/file.py Adds an authorization check via auth() inside Operate.delete(...) before deleting a file.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread apps/oss/views/file.py
Comment on lines +69 to +74
return result.success(FileSerializer.Operate(
data={
"id": file_id,
"http_range": request.headers.get("Range", ""),
}
).delete(mk_file_auth=request.COOKIES.get("mk_file_auth")))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants