fix(api): scope batch bulk-delete to the calling API key - #12969

Merged

diegosouzapw merged 11 commits into

release/v3.8.51from

fix/batches-delete-completed-authz

Sep 14, 2026

Commits on Sep 7, 2026

fix(api): scope batch bulk-delete to the calling API key
diegosouzapw
committed
3355012

Commits on Sep 10, 2026

fix(api): explicit scope, audit log and atomic sweep for DELETE /v1/batches/delete-completed (omni-code-review battery on #12969) (#13262)
diegosouzapw
authored
150ca00

Commits on Sep 11, 2026

fix(api): reject revoked, deactivated, banned or expired keys on DELETE /v1/batches/delete-completed (omni-code-sec on #12969) (#13297)
diegosouzapw
authored
1eac022
feat(db): deleteFileOwnedBy — owner-scoped file soft delete
diegosouzapw
committed
3bf006d
fix(db): key-scoped batch sweep soft-deletes only the key's own files (SEC-C)
diegosouzapw
committed
46b24d9
perf(db): instance-wide completed-batch sweep commits in 200-batch chunks (SEC-D)
diegosouzapw
committed
3fc22c6
test(api): session fixture mints the login shape; changelog covers SEC-C/SEC-D
diegosouzapw
committed
f23a759
fix(db): key-scoped completed-batch sweep never binds more than INSTANCE_SWEEP_CHUNK ids per statement
diegosouzapw
committed
92ca71c

Commits on Sep 14, 2026