feat: enforce trusted session identity

This commit is contained in:
Codex
2026-06-28 21:56:11 +08:00
parent 1d873b2e50
commit 523b63c53b
23 changed files with 502 additions and 201 deletions

View File

@@ -40,8 +40,8 @@ function jsonArrayBodyValue(value: unknown) {
}
export async function profileMeRoute(ctx: RequestContext) {
const tenantId = tenantIdFrom(ctx);
const userId = userIdFrom(ctx);
const tenantId = await tenantIdFrom(ctx);
const userId = await userIdFrom(ctx);
const limit = intParam(ctx, 'recentLimit', 8, 50);
const profile = await queryOne<ProfileRow>(
@@ -198,8 +198,8 @@ export async function profileMeRoute(ctx: RequestContext) {
export async function updateProfileMeRoute(ctx: RequestContext) {
const body = await readJsonBody(ctx);
const tenantId = tenantIdFrom(ctx);
const userId = userIdFrom(ctx, body);
const tenantId = await tenantIdFrom(ctx);
const userId = await userIdFrom(ctx, body);
const name = optionalString(body, 'name') || null;
const avatarUrl = optionalString(body, 'avatarUrl') || null;