rhmatzeka eb30409fc5 fix(skills): authorize laravel-security download on the model before signing a URL ...

The secure-storage example authorized `download` against a raw path string
taken from the request and generated the temporary URL before the check.
A string argument never resolves to a policy, and authorizing a
client-supplied path teaches an IDOR-prone pattern.

Bind a model (Document), authorize against it first, then sign the URL for
the stored path on the s3 disk configured just below. pi/core regenerated
via scripts/build-pi-core.js; skill-triggers registryDigest rebound.

2026-09-30 11:32:33 +07:00

..

core

fix(skills): authorize laravel-security download on the model before signing a URL

2026-09-30 11:32:33 +07:00