Evan JarrettandClaude Fable 5.1 c1234cb31c hold: require a login on getQuota and answer only for the caller's own DID ...

getQuota was public, so anyone could look up any user's storage usage and
plan tier by DID. It now sits behind requireAuth and returns 403 unless the
service token's issuer is the userDid being asked about.

Every appview caller sends the user's service token for the hold: the push
gate reuses the token the push already minted (and still fails open if it
can't get one), the quota webhook event carries the push's token, and the
storage settings panel fetches one for the signed-in user.

Deploy the appview before the hold. An old appview against the new hold
gets 401s: the push gate fails open and the storage panel shows an error.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

2026-09-29 20:52:51 -05:00

..

research

minor bugfix in wrangler, add permissioned data research

2026-08-08 21:24:00 -05:00

APPVIEW-UI-FUTURE.md

add SBOM package diffing, verify hold-service captain records

2026-06-13 12:49:03 -05:00

appview.md

remove the runtime test_mode switch; the testmode build tag is the only one

2026-09-11 11:09:44 -05:00

ARTIFACT_TYPES.md

docs: design note for artifact type classification

2026-09-02 21:43:09 -05:00

BILLING.md

add SBOM package diffing, verify hold-service captain records

2026-06-13 12:49:03 -05:00

BYOS.md

appview: read the sailor profile from the local users row, not the PDS, per request

2026-09-09 20:42:58 -05:00

CONFIG_BLOB_STORAGE.md

clean up GC implementation

2026-02-11 20:44:07 -06:00

CREDENTIAL_HELPER.md

appview: render the install scripts from config instead of shipping ATCR's

2026-09-02 21:38:10 -05:00

DEVELOPMENT.md

remove the runtime test_mode switch; the testmode build tag is the only one

2026-09-11 11:09:44 -05:00

DIRECT_HOLD_ACCESS.md

add SBOM package diffing, verify hold-service captain records

2026-06-13 12:49:03 -05:00

HOLD_DISCOVERY.md

remove the runtime test_mode switch; the testmode build tag is the only one

2026-09-11 11:09:44 -05:00

HOLD_PUSH_OFFLOAD.md

appview: read the sailor profile from the local users row, not the PDS, per request

2026-09-09 20:42:58 -05:00

HOLD_XRPC_ENDPOINTS.md

hold: require a login on getQuota and answer only for the caller's own DID

2026-09-29 20:52:51 -05:00

hold.md

remove the runtime test_mode switch; the testmode build tag is the only one

2026-09-11 11:09:44 -05:00

HORIZONTAL_SCALING.md

appview: stop the backfill claiming every user was just active

2026-08-12 09:24:26 -05:00

KNOWN_RELAYS.md

docs: record how a hold falls off the relay and stays off

2026-09-02 22:30:37 -05:00

LAYER_RECORDS.md

docker push works, hold endpoints require auth

2025-10-18 20:11:36 -05:00

OAUTH.md

add SBOM package diffing, verify hold-service captain records

2026-06-13 12:49:03 -05:00

PERFORMANCE_BACKLOG.md

docs: move presign memoization to the done list

2026-09-11 17:19:10 -05:00

PULL_COUNT_RESEARCH.md

digest page improvements

2026-03-29 13:01:40 -07:00

QUOTAS.md

hold: require a login on getQuota and answer only for the caller's own DID

2026-09-29 20:52:51 -05:00

RELAY.md

post to bluesky when manifests uploaded. linting fixes

2025-10-23 12:24:04 -05:00

REMOVING_DISTRIBUTION.md

remove distribution from hold, add vulnerability scanning in appview.

2026-02-13 15:26:24 -06:00

SBOM_SCANNING.md

scanner: reclaim scan directories a killed process left behind

2026-09-08 21:59:58 -05:00

TROUBLESHOOTING.md

docs: record how a hold falls off the relay and stays off

2026-09-02 22:30:37 -05:00

VALKEY_MIGRATION.md

fix issues pulling other users images. fix labels taking priority over annotations. fix various auth errors

2025-12-23 16:20:52 -06:00

WEBHOOKS.md

add webhook for storage quota percentage

2026-05-17 19:57:09 -05:00