Bug #152
open[HR][Verify] D-32: Employee documents return raw Azure SAS URLs, valid 7 days, no login
0%
Description
Document lists and generated letters hand the browser raw Azure links. buildProxyUrl has no callers in this surface and there is no download endpoint to proxy through. Reproduce: open a returned document link in a private browser window. Part of #143.
SV Updated by Sravan V S about 2 months ago
- Assignee set to Sravan V S
S- Updated by SK - 12 days ago
- Status changed from New to Resolved
- Assignee changed from SK - to Roshni Harish.
- Resolved By set to SK -
Already fixed - confirmed live in current dev. This is the exact bug #143 fixed earlier today (raw Azure SAS URLs). Verified directly in the merged code: EmployeeDocumentsController's own doc comment now states "uploads stream through IDocumentStorage, and every download goes through this controller's own permission-checked /download action — never a direct SAS-URL-returning controller" - and the download action streams file bytes server-side after a permission check, rather than returning a bare link. Generated letters were migrated the same way.
Marking resolved on the code side. The ticket's own repro ("open a returned document link in a private browser window") is a live/deployed-box check - worth a QA pass on the test box once deployed, assigning to Roshni for that.
RH Updated by Roshni Harish. 3 days ago
- Target version set to Product Backlog
RH Updated by Roshni Harish. 3 days ago
- Assignee changed from Roshni Harish. to Sravan V S