Closes #104 These were the only session endpoints carrying ApplicantOrOperator without a resource-based ownership check. The policy asserts the caller holds some applicant or operator credential; it says nothing about which session that credential names, which is the whole point of the per-session token. Upload trusted the route's sessionId, so any applicant token could write documents into any session - landing a Submission row that reads in the operator console as the real applicant's upload. Download was worse than an absent check. sessionId and nodeId were in the route but never reached the service, which resolved the file id straight from blob storage: any authenticated caller could fetch any stored document given its id, with the path segments that appeared to scope the request doing nothing. These are identity and address documents, and the ids are not secrets - they are returned to the browser, stored in Submission.DataJson and shown in the operator console. Both now run the ownership check the other endpoints use: Write for upload, so the terminal-status rule applies too, and Read for download. Ownership alone would not close the read, since the owner of one session could still request another's file through their own route. The lookup is now scoped: GetDocumentAsync takes the session and node, and resolves a file only if an upload recorded against them carries the id. The port signature changed rather than a check being added beside it, so the unscoped path cannot be called at all. A file belonging elsewhere returns 404, not 403, since a refusal would confirm the id is real. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Commits

Commits on Sep 13, 2026

fix(api): scope document upload and download to the session