Repository navigation
[SECURITY][FLEET DOCUMENTS] Store vehicle uploads privately with authorized retrieval #189
Description
Summary
Administrator vehicle uploads are written to publicly accessible blob URLs and the raw blob response is returned. Registration, insurance, inspection, or ownership images can therefore bypass application authorization.
Repository evidence
app/api/upload/route.ts:180-187writes vehicle files withaccess: "public"and returns the blob object.- The KYC path in the same route uses an application-controlled document record, showing the missing boundary for fleet files.
Scope
- Use private storage references and a fleet-document download route with role/resource authorization.
- Persist ownership, purpose, checksum, retention, and access audit metadata.
Acceptance criteria
- Direct public URLs cannot retrieve fleet documents.
- Authorized reads are no-store and auditable.
Tests
- Cover admin upload/read, unauthorized access, expired/deleted records, and guessed storage keys.
Non-goals
- Changing vehicle image presentation for deliberately public marketing assets.
Activity
JONAH-6 commentedon Aug 25, 2026
I have experience with TypeScript and secure file storage. I’ll move fleet documents to private storage, add authorized retrieval with audit metadata, and test admin access, unauthorized requests, expired/deleted records, and guessed storage keys.
grantfox-oss commentedon Aug 26, 2026
🦊 GrantFox — @JONAH-6 has been assigned to this issue as part of the Third Campaign campaign!
Next steps:
Closes #189)Good luck! Track your progress on GrantFox.
grantfox-oss commentedon Aug 28, 2026
🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!
@JONAH-6's PR #228 was approved and merged by @Obiajulu-gif.
🏆 @JONAH-6: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (672 total points). Track your full progress on GrantFox.
👏 Great work, @JONAH-6! Keep contributing to Chainmove.