@@ -5,7 +5,7 @@ import { MountManager } from "../../storage/managers/MountManager.js";
55import { FileSystem } from "../../storage/fs/FileSystem.js" ;
66import { getEncryptionSecret } from "../../utils/environmentUtils.js" ;
77import { usePolicy } from "../../security/policies/policies.js" ;
8- import { findUploadSessionById , updateUploadSessionById } from "../../utils/uploadSessions.js" ;
8+ import { findUploadSessionById , normalizeUploadSessionUserId , updateUploadSessionById } from "../../utils/uploadSessions.js" ;
99import { validateFsItemName } from "../../storage/fs/utils/FsInputValidator.js" ;
1010
1111/**
@@ -93,6 +93,24 @@ export const registerMultipartRoutes = (router, helpers) => {
9393 return { db : c . env . DB , encryptionSecret : getEncryptionSecret ( c ) , repositoryFactory : c . get ( "repos" ) , userInfo, userIdOrInfo, userType } ;
9494 } ;
9595
96+ const assertUploadSessionOwnedByUser = ( sessionRow , userIdOrInfo , userType ) => {
97+ if ( ! sessionRow ) {
98+ throw new ValidationError ( "未找到对应的上传会话" ) ;
99+ }
100+
101+ const expectedUserId = normalizeUploadSessionUserId ( userIdOrInfo , userType ) ;
102+ const rowUserId = String ( sessionRow . user_id || "" ) ;
103+ const rowUserType = String ( sessionRow . user_type || "" ) ;
104+
105+ // 必须至少匹配 user_id；user_type 为空时视为兼容旧数据（不做强校验）
106+ const idMatches = rowUserId === String ( expectedUserId || "" ) ;
107+ const typeMatches = ! rowUserType || rowUserType === String ( userType || "" ) ;
108+
109+ if ( ! idMatches || ! typeMatches ) {
110+ throw new AuthenticationError ( "上传会话不属于当前用户，拒绝访问" ) ;
111+ }
112+ } ;
113+
96114 const assertValidFileName = ( fileName ) => {
97115 const result = validateFsItemName ( fileName ) ;
98116 if ( result . valid ) return ;
@@ -148,6 +166,9 @@ export const registerMultipartRoutes = (router, helpers) => {
148166 assertValidFileName ( fileName ) ;
149167 }
150168
169+ const sessionRow = await findUploadSessionById ( db , { id : uploadId } ) ;
170+ assertUploadSessionOwnedByUser ( sessionRow , userIdOrInfo , userType ) ;
171+
151172 const mountManager = new MountManager ( db , encryptionSecret , repositoryFactory , { env : c . env } ) ;
152173 const fileSystem = new FileSystem ( mountManager ) ;
153174 const safeParts = Array . isArray ( parts ) ? parts : [ ] ;
@@ -167,6 +188,9 @@ export const registerMultipartRoutes = (router, helpers) => {
167188
168189 assertValidFileName ( fileName ) ;
169190
191+ const sessionRow = await findUploadSessionById ( db , { id : uploadId } ) ;
192+ assertUploadSessionOwnedByUser ( sessionRow , userIdOrInfo , userType ) ;
193+
170194 const mountManager = new MountManager ( db , encryptionSecret , repositoryFactory , { env : c . env } ) ;
171195 const fileSystem = new FileSystem ( mountManager ) ;
172196 await fileSystem . abortFrontendMultipartUpload ( path , uploadId , fileName , userIdOrInfo , userType ) ;
@@ -200,6 +224,9 @@ export const registerMultipartRoutes = (router, helpers) => {
200224
201225 assertValidFileName ( fileName ) ;
202226
227+ const sessionRow = await findUploadSessionById ( db , { id : uploadId } ) ;
228+ assertUploadSessionOwnedByUser ( sessionRow , userIdOrInfo , userType ) ;
229+
203230 const mountManager = new MountManager ( db , encryptionSecret , repositoryFactory , { env : c . env } ) ;
204231 const fileSystem = new FileSystem ( mountManager ) ;
205232 const result = await fileSystem . listMultipartParts ( path , uploadId , fileName , userIdOrInfo , userType ) ;
@@ -219,6 +246,9 @@ export const registerMultipartRoutes = (router, helpers) => {
219246
220247 const safePartNumbers = Array . isArray ( partNumbers ) ? partNumbers : [ ] ;
221248
249+ const sessionRow = await findUploadSessionById ( db , { id : uploadId } ) ;
250+ assertUploadSessionOwnedByUser ( sessionRow , userIdOrInfo , userType ) ;
251+
222252 // 状态机推进：请求分片 URL 视为“开始上传”
223253 try {
224254 await updateUploadSessionById ( db , {
@@ -266,9 +296,7 @@ export const registerMultipartRoutes = (router, helpers) => {
266296 const contentLength = contentLengthHeader ? Number . parseInt ( contentLengthHeader , 10 ) || 0 : 0 ;
267297
268298 const sessionRow = await findUploadSessionById ( db , { id : uploadId } ) ;
269- if ( ! sessionRow ) {
270- throw new ValidationError ( "未找到对应的上传会话" ) ;
271- }
299+ assertUploadSessionOwnedByUser ( sessionRow , userIdOrInfo , userType ) ;
272300
273301 const mountManager = new MountManager ( db , encryptionSecret , repositoryFactory , { env : c . env } ) ;
274302 const fileSystem = new FileSystem ( mountManager ) ;
0 commit comments