justme 78b4e2aa63 fix(server): trim every workspace structure response to the caller's grants and restrict avatars to shared spaces ...

- structure mutations returned the full structure to any member who could call them (moving an item after sending a message exposed channels the member has no access to)
- moving items now requires write access to the destination channel; new folders require an existing channel
- account avatars are only readable by the owner or accounts sharing a space

2026-10-17 21:31:15 +08:00

..

WebDrop.Api.Tests

feat(server): lossy avatar thumbnails, gzip upload and separate avatar endpoints

2026-10-17 14:35:41 +08:00

WebDrop.Core.Tests

fix(server): trim every workspace structure response to the caller's grants and restrict avatars to shared spaces

2026-10-17 21:31:15 +08:00