Repository navigation
rescued stash: fix-9300-merge-main: da5155a0a feat(integrations): mobile device pairing UI for push and o #14089
Description
Child of #14078. The work is safe — it is now a branch on origin, not only a stash entry.
| Branch | rescued/stash-2026-06-03-44ddffdb4 |
| Stash commit | 44ddffdb4faa5c2d844a72e9b86385db78ab50ff |
| Stashed | 2026-06-03 |
| Change | 3 files changed, 45 insertions(+), 17 deletions(-) |
| Applies to current base | CONFLICTED |
| Original context | fix-9300-merge-main: da5155a feat(integrations): mobile device pairing UI for push and o |
Files touched:
autobot-backend/transcriber/routes/ai.pyautobot-backend/transcriber/routes/projects.pyautobot-backend/transcriber/routes/transcripts.py
Why this exists: the repo-wide stash stack held 113 entries spanning three months, unowned and
unlinked. This one's content is absent from Dev_new_gui — verified by git apply --check --3way
— so it is genuinely unfinished work, not a leftover of something that already landed.
Ask — a decision, not a deletion:
- Is this work still wanted? The original context above names where it came from (feat(integrations): mobile device pairing for push and offline sync #4463 ).
- Wanted → rebase
rescued/stash-2026-06-03-44ddffdb4ontoDev_new_gui, open a PR, land it. - Not wanted → say so here with the reason, then delete the branch. A recorded decision, never a
silent drop.
Note: this one does not apply cleanly to today's base — expect a real rebase, not a fast-forward.
Activity
mrveiss commentedon Aug 25, 2026
Disposition: LANDED — and it was a security fix, so worth stating precisely what landed
The stash's three files (
transcriber/routes/{ai,projects,transcripts}.py) add per-user ownershipchecks to the transcriber routes: a
_user_id(request)helper, and404instead of a silent readwhenever the requesting user does not own the project / recording / segment. That is an IDOR/BOLA
fix.
Evidence — the same protection is in
origin/Dev_new_guitoday, and is broader:transcriber/routes/projects.py_user_id()at :17;can_access(project, _user_id(request))guardsget_project:43,update_project:56,delete_project:68;list_projects:36 andcreate_project:24 are user-scopedtranscriber/routes/transcripts.py_user_id():28;_require_recording_owner():33 guards eight endpoints (:45, :61, :72, :87, :103, :114, :124) — the stash guarded threetranscriber/routes/ai.pycan_access(rec, _user_id(request)):39Landing commits:
6036d57caefeat(transcriber): add transcript editing API (MVA-2173) (#9350)introduced
_require_recording_owner;e2a6cdb1eefeat(backend): mount transcripts router withreal storage backing (#9863) (#9955) introduced the shared
can_accesshelper.Decision: landed, and superseded by a more complete implementation.
rescued/stash-2026-06-03-44ddffdb4-trackedis disposable; left in place — branch deletion is a separate deliberate act.
mrveiss commentedon Aug 25, 2026
Disposition: LANDED — and it was a security fix, so worth stating precisely what landed
The stash's three files (
transcriber/routes/{ai,projects,transcripts}.py) add per-user ownershipchecks to the transcriber routes: a
_user_id(request)helper, and404instead of a silent readwhenever the requesting user does not own the project / recording / segment. That is an IDOR/BOLA
fix.
Evidence — the same protection is in
origin/Dev_new_guitoday, and is broader:transcriber/routes/projects.py_user_id()at :17;can_access(project, _user_id(request))guardsget_project:43,update_project:56,delete_project:68;list_projects:36 andcreate_project:24 are user-scopedtranscriber/routes/transcripts.py_user_id():28;_require_recording_owner():33 guards eight endpoints (:45, :61, :72, :87, :103, :114, :124) — the stash guarded threetranscriber/routes/ai.pycan_access(rec, _user_id(request)):39Landing commits:
6036d57caefeat(transcriber): add transcript editing API (MVA-2173) (#9350)introduced
_require_recording_owner;e2a6cdb1eefeat(backend): mount transcripts router withreal storage backing (#9863) (#9955) introduced the shared
can_accesshelper.Decision: landed, and superseded by a more complete implementation.
rescued/stash-2026-06-03-44ddffdb4-trackedis disposable; left in place — branch deletion is a separate deliberate act.