Claude ff48c99d6c fix(stream): address code review findings on resume-stream ... - Critical (auth): the resume-stream handler verified chat ownership but not that the requested message_id actually lives in that chat. Because the Redis log is keyed by message_id alone, an attacker who learned a victim's message_id could pass one of their own chat_ids to satisfy the ownership check and replay the victim's stream. Added an explicit message-to-chat binding check via Chats.get_message_by_id_and_message_id after the ownership check. - Safety: reject non-dict payloads (`if not isinstance(data, dict)`) so stray client input — string/list/null — doesn't raise AttributeError on `data.get(...)`. - Perf: the per-token log append was doing two Redis round-trips (XADD + EXPIRE) on the streaming hot path. Collapse them into a single pipeline execute (one RTT), and refresh the TTL only every 64 appends instead of every append. With a 1h TTL that still leaves comfortable headroom for even pathologically long responses without EXPIRE ever risking mid-stream expiry. - Protocol cleanup: removed the resume-stream:ack emission. The frontend doesn't consume it and YAGNI — the seq idempotency guard in chatEventHandler already delivers the observability (you can see last_seq advance as replays arrive). Can be added back when a concrete client-side use case appears.		2026-04-14 21:16:39 +00:00
..
main.py	fix(stream): address code review findings on resume-stream	2026-04-14 21:16:39 +00:00
utils.py	refac	2026-03-22 05:48:05 -05:00