fix(security): stop serving and restoring deleted bundle cache by riderx · Pull Request #3100 · Cap-go/capgo.app

riderx · 2026-08-16T20:28:41Z

Summary (AI generated)

File serve now 404s cache hits for deleted bundles (deleted / deleted_at or a deleted cache marker) and does not write those objects back to R2.
Version delete in on_version_update purges the same files Cache API keys and sets a deleted marker the serve path honors.
Fixes GHSA-26x3-6mr7-989p: deleted bundles could keep being downloaded from edge cache and restored into R2.

Motivation (AI generated)

Soft-deleted versions were moved to R2 trash without invalidating the files worker cache. A later cache hit could still serve the zip and put it back into R2, so deleted bundles stayed available.

Business Impact (AI generated)

Customers who delete a bundle can rely on that version becoming undownloadable. This closes a security hole where deleted release artifacts remained reachable and could be resurrected.

Test Plan (AI generated)

Unit test: cached deleted version returns 404 and does not call R2 put
Unit test: deleted cache marker 404s without a database lookup
Unit test: deleteIt calls purgeFileReadCache for the version r2_path
Existing files cache/bandwidth/R2 unit tests still pass

Generated with AI

Made with Cursor

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

coderabbitai · 2026-08-16T20:28:50Z

Warning

Review limit reached

Run on-demand review

_{On-demand reviews are free for the next 26 days. After that, they cost $0.25 per reviewed file.}

Or wait 52 minutes for your next included review.

View limit details

Limit details: You’ve used the included review currently available. Your 62 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: dc1457bb-8e67-4bfc-93c2-da49eff059b3

📥 Commits

Reviewing files that changed from the base of the PR and between 3633ef8 and c903b42.

📒 Files selected for processing (9)

cloudflare_workers/files/index.ts
supabase/functions/_backend/files/file_read_cache.ts
supabase/functions/_backend/files/files.ts
supabase/functions/_backend/triggers/on_version_update.ts
tests/files-app-read-guard.unit.test.ts
tests/files-bandwidth.unit.test.ts
tests/files-deleted-cache.unit.test.ts
tests/files-r2-error.test.ts
tests/on-version-update-cleanup.unit.test.ts

_{Comment @coderabbitai help to get the list of available commands.}

codspeed-hq · 2026-08-16T20:30:44Z

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

_{Comparing fix/security-ghsa-26x3-deleted-cache (c903b42) with main (3633ef8)}

2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

TorichanCapgo · 2026-08-24T14:39:38Z

Ready for Martin review/merge when CI is green. Please do not include advisory identifiers in follow-up commits.

cubic-dev-ai

All reported issues were addressed across 9 files

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

TorichanCapgo · 2026-08-25T06:19:35Z

Triage 2026-08-25: previous “ready for Martin” comment is withdrawn.

This PR is not fully ready per AGENTS.md: automatic review has not APPROVED (CodeRabbit was rate-limited or only commented). CI must be green on the latest head and AI review fully clear before any human ping.

@coderabbitai review

coderabbitai · 2026-08-25T06:19:48Z

@TorichanCapgo I will review pull request #3100.

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

Deleted versions stayed downloadable from the files edge cache and could be written back to R2. Purge that cache on delete and 404 cache hits for deleted or marked bundles. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

…elete" This reverts commit dd49c2d.

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor · 2026-08-25T15:57:20Z

@coderabbitai review

cursor · 2026-08-25T16:13:25Z

@coderabbitai review

Unit test fix: files-bandwidth.unit.test.ts now mocks getPgClient with a non-deleted version lookup (same pattern as files-r2-error / files-deleted-cache), so the new isAttachmentVersionDeleted guard no longer 404s bandwidth tests.

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor · 2026-08-25T17:03:22Z

@coderabbitai full review

Latest head 3b646acf2 fixes files-bandwidth.unit.test.ts pg mocks for the deleted-version guard; unit tests pass locally.

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor · 2026-08-25T18:11:19Z

@coderabbitai review

All 8 review threads resolved. Latest head 3b646acf2 adds pg client mocks to bandwidth unit tests for the deleted-bundle guard. Unit tests pass locally.

sonarqubecloud · 2026-08-25T18:16:53Z

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

cursor · 2026-08-25T18:17:41Z

@coderabbitai full review

cursor · 2026-08-25T18:24:13Z

@coderabbitai review

Latest head c903b4206 — all 76 CI checks green, 0 open threads. Please approve.

riderx temporarily deployed to deepsec-pr August 16, 2026 20:28 — with GitHub Actions Inactive

riderx temporarily deployed to deepsec-pr August 16, 2026 20:31 — with GitHub Actions Inactive

riderx had a problem deploying to deepsec-pr August 16, 2026 20:33 — with GitHub Actions Error

riderx temporarily deployed to deepsec-pr August 16, 2026 20:33 — with GitHub Actions Inactive

TorichanCapgo marked this pull request as ready for review August 24, 2026 14:39

cubic-dev-ai Bot reviewed Aug 24, 2026

View reviewed changes

riderx and others added 5 commits August 25, 2026 15:55

fix(security): stop serving and restoring deleted bundle cache

e766d31

Deleted versions stayed downloadable from the files edge cache and could be written back to R2. Purge that cache on delete and 404 cache hits for deleted or marked bundles. Co-authored-by: Cursor <cursoragent@cursor.com>

fix(security): satisfy deleted-cache typecheck

d863326

Co-authored-by: Cursor <cursoragent@cursor.com>

test(security): accept bundle.delete trigger on upload soft-delete

fa25cb7

Co-authored-by: Cursor <cursoragent@cursor.com>

Revert "test(security): accept bundle.delete trigger on upload soft-d…

7700db2

…elete" This reverts commit dd49c2d.

fix(security): harden deleted bundle cache purge and serve paths

4077f6d

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot force-pushed the fix/security-ghsa-26x3-deleted-cache branch from 826c2fe to 4077f6d Compare August 25, 2026 15:57

cursor Bot deployed to deepsec-pr August 25, 2026 15:57 Active

test(files): mock pg client in bandwidth unit tests for deleted guard

3b646ac

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot deployed to deepsec-pr August 25, 2026 16:13 Active

cursor Bot mentioned this pull request Aug 25, 2026

fix(security): content-lock channel-linked r2-direct bundles #3098

Open

4 tasks

ci: retrigger pull_request test workflow

c903b42

Co-authored-by: Martin DONADIEU <martindonadieu@gmail.com>

cursor Bot deployed to deepsec-pr August 25, 2026 18:11 Active

Uh oh!

Uh oh!

Conversation

riderx commented Aug 16, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary (AI generated)

Motivation (AI generated)

Business Impact (AI generated)

Test Plan (AI generated)

Uh oh!

coderabbitai Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

codspeed-hq Bot commented Aug 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merging this PR will not alter performance

Footnotes

Uh oh!

TorichanCapgo commented Aug 24, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

TorichanCapgo commented Aug 25, 2026

Uh oh!

coderabbitai Bot commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 25, 2026

Uh oh!

cursor Bot commented Aug 25, 2026

Uh oh!

cursor Bot commented Aug 25, 2026

Uh oh!

cursor Bot commented Aug 25, 2026

Uh oh!

sonarqubecloud Bot commented Aug 25, 2026

Quality Gate passed

Uh oh!

cursor Bot commented Aug 25, 2026

Uh oh!

cursor Bot commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

riderx commented Aug 16, 2026 •

edited by cubic-dev-ai Bot

Loading

coderabbitai Bot commented Aug 16, 2026 •

edited

Loading

codspeed-hq Bot commented Aug 16, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

coderabbitai Bot commented Aug 25, 2026 •

edited

Loading