US07-02: Harden API Authorization and Path Boundaries (#84)

2026-08-16 23:07:36 +02:00
parent d143fee4d2
commit d2e44b5657
21 changed files with 1134 additions and 34 deletions
--- a/photo_pipeline/api/routes/thumbnails.py
+++ b/photo_pipeline/api/routes/thumbnails.py
@@ -31,5 +31,7 @@ def get_thumbnail(asset_id: str, request: Request, size: int = Query(512)):
    return FileResponse(
        path,
        media_type="image/webp",
-        headers={"Cache-Control": "public, max-age=31536000, immutable"},
+        # private: the URL is versioned and immutable, but these bytes are the user's
+        # photos and must never sit in a shared cache (US07-02).
+        headers={"Cache-Control": "private, max-age=31536000, immutable"},
    )