Add project listing selector, confirmed revision and private 3MF renders

2026-11-08 18:49:32 +00:00
parent e62b6800a6
commit 4e675510fd
29 changed files with 3394 additions and 14 deletions
@@ -15,4 +15,13 @@ class ProjectFilePolicy
    {
        return $user->role === 'admin' && $file->revision->project_id === $project->id;
    }
+
+    /**
+     * Same IDOR guard as download(): generating or viewing a rendered preview
+     * must only ever be reachable through the project the file actually belongs to.
+     */
+    public function render(User $user, ProjectFile $file, Project $project): bool
+    {
+        return $user->role === 'admin' && $file->revision->project_id === $project->id;
+    }
 }