fix(api): refuse file uploads unless a plugin declared the path - #7851

Open

ar2rsawseen wants to merge 11 commits into

fix/upload-temp-file-cleanup

Commits on Jul 27, 2026

fix(api): bound lifetime of upload temp files

ar2rsawseen
and
claude
committed
fix(api): prevent uploads reaching disk where no endpoint reads them

ar2rsawseen
and
claude
committed
fix(api): refuse file uploads unless a plugin declared the path

ar2rsawseen
and
claude
committed
refactor(api): track upload temp paths instead of a dedicated directory

ar2rsawseen
and
claude
committed
test(api): separate what this repo declares from the enterprise paths

ar2rsawseen
and
claude
committed
test(api): derive the declared upload paths from source

ar2rsawseen
and
claude
committed