Beta media-upload permission gate: admin-approved uploads + grant-request emails - #302
Open
lopugit wants to merge 6 commits into
Open
Beta media-upload permission gate: admin-approved uploads + grant-request emails#302lopugit wants to merge 6 commits into
lopugit wants to merge 6 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
✅ Develop S3 preview ready
The alias passed the develop bucket CORS preflight and a final live PR/SHA fence. Generic Vercel Preview deployments use the shared development runtime; this controller adds the stable exact-SHA alias and marker-scoped cleanup. |
lopugit
added a commit
that referenced
this pull request
Aug 18, 2026
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
🤝 Merged Conflicted files:
Please review the merge commit before relying on it. |
github-actions
Bot
added
the
ai-rebase-in-progress
Contributor
|
🤖 Auto-rebase running — the stack rebase started working on this PR at 13:14 UTC. Expected to finish around 13:29 UTC (most rebases still land in 5-15 minutes; the hosted-runner ceiling is 360). On success this branch is force-pushed onto its new base and a result comment follows — no manual action is needed meanwhile. |
github-actions
Bot
added
ai-rebase-paused
Contributor
|
|
lopugit
removed
the
ai-rebase-paused
github-actions
Bot
added
the
ai-rebase-in-progress
lopugit
added a commit
that referenced
this pull request
Aug 18, 2026
…on) into moderation branch Brings the PR #301/#302 upload-gate consolidation and current develop into the moderation stack; resolves TESTING/CHANGELOG/package.json overlaps keeping both the consolidated gate story and the moderation additions. attachments 108/108, moderation 10/10, migrations 19/19 on the merged tree. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions
Bot
removed
the
ai-rebase-in-progress
Contributor
|
The PR changed refs or resolver ownership, so no pause was added; the current state remains eligible for automatic re-detection. |
github-actions
Bot
added
the
ai-rebase-in-progress
lopugit
added a commit
that referenced
this pull request
Aug 18, 2026
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
github-actions
Bot
added
the
ai-rebase-in-progress
github-actions
Bot
removed
the
ai-rebase-in-progress
Contributor
|
The PR changed refs or resolver ownership, so no pause was added; the current state remains eligible for automatic re-detection. |
github-actions
Bot
added
the
ai-rebase-in-progress
…flow
New users cannot upload media/files until an admin grants the per-account
meta.mediaUpload permission (root secureMediaUpload on user things,
mirroring the admin flag's dual-store pattern). Upload start/parts/complete
return 403 { code: media_upload_not_granted } for ungranted accounts;
abort/delete stay open so revoked users can clean up drafts. Every
registration emails THINGTIME_ADMIN_EMAIL (default admin@thingtime.com)
requesting a grant; /admin -> Users gains Grant/Revoke media controls via
POST /api/v1/admin/set-media-upload; the attachment composer shows an
approval-pending card to ungranted accounts; and the
grant-media-upload-to-existing-users migration grandfathers pre-gate
accounts. Verified live: register -> 403 gate + admin email recorded, unit
suite + lint green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
… one permission PR #301 (signup-permissions hotfix, now on main) and this branch shipped the same feature in parallel; after the AI resolver merged develop in, BOTH gates were enforced and no single admin toggle could unblock a new account. Consolidate on #301's tri-state meta.publicUploads as the one stored permission: canUploadMediaDoc (auth/mediaUpload.ts) is now THE predicate, userPublicUploadsEnabled delegates to it, and PublicUser.canUploadMedia / publicUploadsEnabled can never drift. Removed as duplicates: the meta.mediaUpload / secureMediaUpload storage, setUserMediaUpload, POST /api/v1/admin/set-media-upload (+docs/useApi/UI/guard test), the registration-time admin email (+template/env — #301's verification-time admin.new_user alert is the consolidated notification), and the grant-media-upload-to-existing-users migration (absent = grandfathered). Kept: the composer approval-pending card, media_upload_not_granted client copy, requireUploadGrant on parts/complete, and the route gate tests. attachments 108/108, migrations 19/19, full test:unit exit 0, lint clean. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Refreshed by the rebase-pr-stacks workflow: https://github.com/lopugit/thingtime/actions/runs/32119043776
Refreshed by the rebase-pr-stacks workflow: https://github.com/lopugit/thingtime/actions/runs/32141232529
lopugit
force-pushed
the
claude/media-upload-permission-gate
branch
from
August 18, 2026 13:29
780a385 to
b695585
Compare
github-actions
Bot
removed
the
ai-rebase-in-progress
Contributor
|
🧬 Rebased
The branch was published once with an exact force-with-lease. Please review the rewritten commits before relying on them. |
…I rebase The rebase replayed pre-integration commits, resurrecting the purpose-blind requireUploadGrant gate (which 403s #310 private-only accounts on message/ profile uploads), the single-flag canUploadMediaDoc + its userPublicUploadsEnabled delegation, the purpose-blind composer card, and the dead set-media-upload docs entry/useApi method. Restore the verified integrated versions (commit 780a385 content): purpose-aware gate only, any-scope alias predicate, purpose-aware composer card, scoped error copy, scoped tests. attachments 111/111, full nitro build green. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lopugit
added a commit
that referenced
this pull request
Aug 18, 2026
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
lopugit
added a commit
that referenced
this pull request
Aug 18, 2026
…d uploads + grant-request emails
lopugit
added a commit
that referenced
this pull request
Aug 18, 2026
…d uploads + grant-request emails
github-actions Bot
added a commit
that referenced
this pull request
Aug 18, 2026
…d uploads + grant-request emails
github-actions Bot
added a commit
that referenced
this pull request
Aug 19, 2026
…d uploads + grant-request emails
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Beta media-upload permission gate + admin approval flow
During the beta, new users cannot upload media or files until a Thingtime admin manually grants their account the permission. Every registration emails the admin inbox requesting a grant. This is Phase A of the NSFW/TOS media-moderation programme (analysis pipeline lands in a follow-up PR stacked on this branch).
Hotfix note
This branch is cut directly from
origin/main(0bd6ee3), so it merges intomaincleanly as a hotfix with no unrelateddevelopcontent. PR base isdevelopper repo policy — retarget or cherry-pick for themainhotfix as you prefer.What's in it
adminflag exactly: root booleansecureMediaUploadon user things /meta.mediaUploadon legacy docs, dual-storesetUserMediaUploadwriter, purecanUploadMediaDocpredicate (admins always pass),PublicUser.canUploadMedia(self-view only; never onPublicProfile).createAttachmentMutationAction):uploads,uploads/parts,uploads/completerequire the grant and return403 { code: "media_upload_not_granted" };abort/deletestay open so revoked accounts can clean up drafts. One gate covers posts, comments, messenger media, custom emoji, and profile avatars/banners (all purposes flow throughstartAttachmentUpload).admin.media_upload_requestemail toTHINGTIME_ADMIN_EMAIL(defaultadmin@thingtime.com) with username/email/user-id and an/adminlink; recorded inemail_messages. Service accounts and temporary users don't page the admin.POST /api/v1/admin/set-media-upload { userId, granted }(mirrorsset-admin; registered in the import map + apiDocs, which auto-adds two docs smoke tests)./admin→ Users gains a purplemediabadge and a per-row Grant media / Revoke media button with Lopu toasts.attachmentUploadErrormaps the new code to friendly copy for direct-API surfaces (profile media).grant-media-upload-to-existing-users: grandfathers every account that exists at run time (both stores, idempotent). Run it once at deploy if existing users should keep uploading; skip it to require approval for everyone.THINGTIME_ADMIN_EMAIL), TESTING.md checklist lines, CHANGELOG entry,PRs/note.Verification
corepack pnpm --dir remix run test:attachments— 104/104 pass, including new gate coverage (403 + stable code for ungranted, pass for granted, cleanup routes stay open, service never invoked when blocked).corepack pnpm --dir remix run test:unit— exit 0, all 25 sub-suites green.corepack pnpm --dir remix run lint:files -- <20 changed files>— clean.POST /api/v1/attachments/uploadsreturned403 { code: "media_upload_not_granted" }; the admin request email was recorded inemail_messagesand (local SES env) actually delivered to admin@thingtime.com;/api/root-datacarriescanUploadMedia:falsefor the fresh account.admin-set-media-upload-guarded+attachments-upload-requires-media-grant.Notes / follow-ups
🤖 Generated with Claude Code