@rubytech/create-sitedesk-code 0.1.519 → 0.1.520

package/payload/platform/plugins/cloudflare/skills/data-portal/schema.sql

@@ -1,8 +1,23 @@
 -- D1 schema for the data portal (data-portal skill).
 --
--- Four tables: who may authenticate (people), who currently is (sessions),
--- what they have dropped (manifest), and how hard they have been trying
--- (auth_attempts). Everything is IF NOT EXISTS so re-applying is safe.
+-- Six tables: who may authenticate (people), who currently is (sessions),
+-- what they have dropped (manifest), how hard they have been trying
+-- (auth_attempts), and what the device has published (directory,
+-- directory_state). Everything is IF NOT EXISTS so re-applying is safe.
+--
+-- This schema is applied to the ONE shared, house-owned database that backs
+-- every portal (Task 2099). `accountId` is therefore the tenant discriminator,
+-- not a hint: it appears on every table carrying client data, the deployed
+-- worker binds its own account into every query from the wrangler var
+-- PORTAL_ACCOUNT_ID, and nothing else separates one client's rows from
+-- another's. `auth_attempts` is the one exception and needs no column, because
+-- the tenant rides inside its `scope` string (see _lib/ratelimit.ts).
+--
+-- A portal provisioned before 2099 has its OWN database with the older shape
+-- and is never migrated in place. IF NOT EXISTS adds no column to an existing
+-- table, so applying this file to such a database silently leaves it as it was.
+-- That is exactly why the shared store must be a freshly created database, and
+-- why those portals stay on their own template until migrated deliberately.
 
 -- One row per enrolled person. No plaintext passcode is ever stored: the
 -- enrolment script generates the passcode, prints it to the operator once, and
@@ -32,14 +47,20 @@
 -- to a `people` table that predates it, and enrolment's INSERT names `folders`,
 -- so it fails loudly on such a table. Add it by hand in that case:
 --   ALTER TABLE people ADD COLUMN folders TEXT NOT NULL DEFAULT '';
+-- The key is (accountId, ownerId), not ownerId alone. On the shared store two
+-- clients may each enrol a person called `rob`, and a bare ownerId key would
+-- reject the second enrolment outright. Worse, the enrolment upsert would treat
+-- it as a rotation and overwrite the first client's person: their passcode,
+-- their folder grant, and the owner of their files.
 CREATE TABLE IF NOT EXISTS people (
-  ownerId    TEXT PRIMARY KEY,
+  ownerId    TEXT NOT NULL,
   name       TEXT NOT NULL,
   salt       TEXT NOT NULL,
   hash       TEXT NOT NULL,
   createdAt  TEXT NOT NULL,
   accountId  TEXT NOT NULL DEFAULT '',
-  folders    TEXT NOT NULL DEFAULT ''
+  folders    TEXT NOT NULL DEFAULT '',
+  PRIMARY KEY (accountId, ownerId)
 );
 
 -- `pcCheck` is a short digest of the person's passcode hash at mint time, and
@@ -48,9 +69,16 @@ CREATE TABLE IF NOT EXISTS people (
 -- every session minted against the old one stops resolving immediately, with
 -- no cleanup step for an operator to remember and no 12-hour window to wait
 -- out. A leaked passcode is exactly the case where a procedural remedy fails.
+--
+-- `accountId` records which portal minted the session. `sessionId` is a global
+-- UUID and is safe as the key on its own, but the resolve joins `people` and
+-- that join must match on both columns: keyed on ownerId alone it can pair a
+-- session with a same-named person belonging to a different client, and hand
+-- back that client's folder grant.
 CREATE TABLE IF NOT EXISTS sessions (
   sessionId TEXT PRIMARY KEY,
   ownerId   TEXT NOT NULL,
+  accountId TEXT NOT NULL DEFAULT '',
   pcCheck   TEXT NOT NULL,
   expiresAt INTEGER NOT NULL,
   createdAt TEXT NOT NULL
@@ -92,22 +120,34 @@ CREATE INDEX IF NOT EXISTS sessions_owner ON sessions (ownerId);
 --   ALTER TABLE manifest ADD COLUMN devicePath TEXT NOT NULL DEFAULT '';
 --   ALTER TABLE manifest ADD COLUMN deleted INTEGER NOT NULL DEFAULT 0;
 -- Their absence is loud: upload names targetPath in its INSERT.
+-- `accountId` is the tenant the row belongs to, and `objectKey` is unique only
+-- within it. A bare `objectKey UNIQUE` is not merely too broad on a shared
+-- store, it is exploitable: the upload upsert conflicts on that key, so one
+-- client uploading at another client's key would take over the existing row,
+-- reset its ingested flag, and redirect the file. The pull loop also filters on
+-- this column, which is what stops one account's sweep collecting another's
+-- pending uploads into its own folder tree.
 CREATE TABLE IF NOT EXISTS manifest (
   id         INTEGER PRIMARY KEY AUTOINCREMENT,
   fileId     TEXT UNIQUE NOT NULL,
+  accountId  TEXT NOT NULL DEFAULT '',
   ownerId    TEXT NOT NULL,
   filename   TEXT NOT NULL,
-  objectKey  TEXT UNIQUE NOT NULL,
+  objectKey  TEXT NOT NULL,
   size       INTEGER NOT NULL,
   uploadedAt TEXT NOT NULL,
   ingested   INTEGER NOT NULL DEFAULT 0,
   targetPath TEXT NOT NULL DEFAULT '',
   devicePath TEXT NOT NULL DEFAULT '',
-  deleted    INTEGER NOT NULL DEFAULT 0
+  deleted    INTEGER NOT NULL DEFAULT 0,
+  UNIQUE (accountId, objectKey)
 );
 
 CREATE INDEX IF NOT EXISTS manifest_uningested ON manifest (ingested);
 CREATE INDEX IF NOT EXISTS manifest_owner ON manifest (ownerId);
+-- The pull and the audit both filter by account on the shared store, so the
+-- discriminator carries its own index rather than riding the owner one.
+CREATE INDEX IF NOT EXISTS manifest_account ON manifest (accountId);
 -- The pull selects `ingested = 0 OR deleted = 1`, so the withdrawal half needs
 -- its own index or a withdrawal costs a full scan every sixty seconds.
 CREATE INDEX IF NOT EXISTS manifest_deleted ON manifest (deleted);

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/authorize.ts

@@ -1,32 +1,41 @@
 // The isolation rule.
 //
-// Every file op authorizes owner-vs-key here BEFORE any R2 call. The
-// per-person key prefix is a consequence of this check, never the check
-// itself: a caller could otherwise reach another person's files by naming
-// them, and prefix convention alone would not stop it.
+// Every file op authorizes tenant-and-owner-vs-key here BEFORE any R2 call. The
+// key prefix is a consequence of this check, never the check itself: a caller
+// could otherwise reach another person's files by naming them, and prefix
+// convention alone would not stop it.
+//
+// There are TWO segments to check, not one (Task 2099). Every portal binds the
+// same shared bucket, so the account segment is the only thing separating one
+// client's objects from another's. Checking the owner segment alone would leave
+// `<other-account>/alice/x.pdf` authorized for this portal's alice, and the
+// delete, download and multipart-complete paths all take the key straight from
+// the client, so this is verified on every call rather than assumed from how
+// the key was built.
 
 const SEP = '/'
 
-// The whole gate rests on an ownerId that cannot contain the separator. If two
-// people were ever enrolled as 'alice' and 'alice/2024', then
+// The whole gate rests on ids that cannot contain the separator. If two people
+// were ever enrolled as 'alice' and 'alice/2024', then
 // 'alice/2024/invoice.pdf' starts with 'alice/' and alice would read the other
-// person's files. Enrolment is an agent writing rows, so this invariant cannot
-// live only in the skill's prose — it is enforced here, where the decision is
-// actually made, and it fails closed.
-const OWNER_ID = /^[a-z0-9-]+$/
+// person's files; the same argument applies to the account segment. Enrolment
+// and assembly are agents writing values, so this invariant cannot live only in
+// the skill's prose. It is enforced here, where the decision is actually made,
+// and it fails closed.
+const SAFE_ID = /^[a-z0-9-]+$/
 
-export function ownerPrefix(ownerId: string): string {
-  return `${ownerId}${SEP}`
+export function ownerPrefix(accountId: string, ownerId: string): string {
+  return `${accountId}${SEP}${ownerId}${SEP}`
 }
 
-export function authorizeKey(ownerId: string, key: string): boolean {
-  if (!ownerId || !key) return false
-  if (!OWNER_ID.test(ownerId)) return false
+export function authorizeKey(accountId: string, ownerId: string, key: string): boolean {
+  if (!accountId || !ownerId || !key) return false
+  if (!SAFE_ID.test(accountId) || !SAFE_ID.test(ownerId)) return false
   // Reject traversal and absolute forms outright rather than normalising them:
   // a normaliser is one more thing that can be wrong, and no legitimate key
   // contains these.
   if (key.includes('..') || key.startsWith(SEP)) return false
-  // startsWith(ownerId) alone would authorize 'alice-evil/...' for 'alice'.
-  // The separator is part of the rule.
-  return key.startsWith(ownerPrefix(ownerId))
+  // startsWith on the bare ids would authorize 'acct-a-evil/...' for 'acct-a'
+  // and 'alice-evil/...' for 'alice'. Both separators are part of the rule.
+  return key.startsWith(ownerPrefix(accountId, ownerId))
 }

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/ratelimit.ts

@@ -19,9 +19,16 @@ export const RATE_MAX_ATTEMPTS = 5
  *  unauthenticated requests naming a person lock that person out of their own
  *  portal for the window, from anywhere, repeatably. Keyed on owner+IP, an
  *  attacker throttles only themselves. The cost is that a distributed guesser
- *  gets RATE_MAX_ATTEMPTS per address, which the passcodes' entropy carries. */
-export function rateScope(ownerId: string, clientIp: string): string {
-  return `${ownerId}|${clientIp}`
+ *  gets RATE_MAX_ATTEMPTS per address, which the passcodes' entropy carries.
+ *
+ *  The account leads the key because the `auth_attempts` table is shared by
+ *  every portal (Task 2099). Two clients who each enrol a person of the same
+ *  name would otherwise share one lockout counter, so traffic against one
+ *  client's portal could lock a different client's person out of theirs. This
+ *  is why the table itself needs no accountId column: the tenant is already
+ *  inside `scope`, and the unique index is on (scope, windowStart). */
+export function rateScope(accountId: string, ownerId: string, clientIp: string): string {
+  return `${accountId}|${ownerId}|${clientIp}`
 }
 
 /** Clear a scope's counter. Called on a successful sign-in, so a person doing

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/session.ts

@@ -31,21 +31,31 @@ export function passcodeCheck(hash: string): string {
 export async function mintSession(
   db: D1Database,
   ownerId: string,
+  accountId: string,
   sessionId: string,
   nowMs: number,
   pcCheck: string,
 ): Promise<string> {
   await db
     .prepare(
-      'INSERT INTO sessions (sessionId, ownerId, pcCheck, expiresAt, createdAt) VALUES (?, ?, ?, ?, ?)',
+      'INSERT INTO sessions (sessionId, ownerId, accountId, pcCheck, expiresAt, createdAt) VALUES (?, ?, ?, ?, ?, ?)',
+    )
+    .bind(
+      sessionId,
+      ownerId,
+      accountId,
+      pcCheck,
+      nowMs + SESSION_TTL_MS,
+      new Date(nowMs).toISOString(),
     )
-    .bind(sessionId, ownerId, pcCheck, nowMs + SESSION_TTL_MS, new Date(nowMs).toISOString())
     .run()
   // Opportunistic GC: expired rows are dead weight and nothing else prunes
-  // them. Scoped to this owner so it stays a small, indexed delete.
+  // them. Scoped to this owner so it stays a small, indexed delete, and to this
+  // account because the store is shared: two portals may hold the same owner
+  // id, and an owner-only delete would prune the other portal's rows.
   await db
-    .prepare('DELETE FROM sessions WHERE ownerId = ? AND expiresAt <= ?')
-    .bind(ownerId, nowMs)
+    .prepare('DELETE FROM sessions WHERE ownerId = ? AND accountId = ? AND expiresAt <= ?')
+    .bind(ownerId, accountId, nowMs)
     .run()
   return sessionId
 }
@@ -53,6 +63,7 @@ export async function mintSession(
 export async function resolveSession(
   db: D1Database,
   sessionId: string,
+  accountId: string,
   nowMs: number,
 ): Promise<{ ownerId: string; accountId: string; folders: string[] } | null> {
   if (!sessionId) return null
@@ -60,18 +71,23 @@ export async function resolveSession(
     .prepare(
       `SELECT s.ownerId AS ownerId, p.accountId AS accountId, p.folders AS folders
          FROM sessions s
-         JOIN people p ON p.ownerId = s.ownerId
+         JOIN people p ON p.ownerId = s.ownerId AND p.accountId = s.accountId
         WHERE s.sessionId = ?
+          AND s.accountId = ?
           AND s.expiresAt > ?
           AND s.pcCheck = substr(p.hash, 1, 16)`,
     )
-    .bind(sessionId, nowMs)
+    .bind(sessionId, accountId, nowMs)
     .first<{ ownerId: string; accountId: string; folders: string }>()
   if (!row || typeof row.ownerId !== 'string') return null
-  // A `people` row predating the accountId column resolves it as absent. Treat
-  // that as "no folders", never as "all folders": the empty string reaches the
-  // listing, which returns nothing rather than falling back to some default.
-  const accountId = typeof row.accountId === 'string' ? row.accountId : ''
+  // The join matches on BOTH columns and the lookup is already scoped to this
+  // portal's own account, which is what stops a same-named person in another
+  // tenant resolving here. A row that still disagrees is a contradiction, and
+  // on a shared store the safe reading of a contradiction is nothing at all.
+  // This also fails closed on a legacy row carrying no accountId, rather than
+  // treating an absent tenant as a match.
+  const resolved = typeof row.accountId === 'string' ? row.accountId : ''
+  if (!resolved || resolved !== accountId) return null
   // `folders` is a comma-separated allowlist of top-level names. Absent or empty
   // means no grant, which the two client surfaces read as no filter (full set).
   const folders =

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/target.ts

@@ -76,16 +76,25 @@ export async function checkTarget(
 }
 
 /**
- * `ownerId/targetPath/filename`, collapsing to `ownerId/filename` when
- * untargeted.
+ * `accountId/ownerId/targetPath/filename`, collapsing to
+ * `accountId/ownerId/filename` when untargeted.
  *
- * The target is IN the key because `objectKey` is UNIQUE. With a flat key the
- * same filename dropped into two folders would collide: the upsert would
- * overwrite the first object, reset its ingested flag, and the first file would
- * never reach the device at all.
+ * The account leads the key because the bucket is shared by every portal (Task
+ * 2099): without it, two clients who each enrol a person of the same name would
+ * write to the same object path.
+ *
+ * The target is IN the key because `objectKey` is unique per account. With a
+ * flat key the same filename dropped into two folders would collide: the upsert
+ * would overwrite the first object, reset its ingested flag, and the first file
+ * would never reach the device at all.
  */
-export function uploadKey(ownerId: string, targetPath: string, filename: string): string {
+export function uploadKey(
+  accountId: string,
+  ownerId: string,
+  targetPath: string,
+  filename: string,
+): string {
   return targetPath
-    ? `${ownerPrefix(ownerId)}${targetPath}/${filename}`
-    : `${ownerPrefix(ownerId)}${filename}`
+    ? `${ownerPrefix(accountId, ownerId)}${targetPath}/${filename}`
+    : `${ownerPrefix(accountId, ownerId)}${filename}`
 }

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/_lib/types.ts

@@ -57,6 +57,22 @@ export interface R2Bucket {
 export interface PortalEnv {
   DB: D1Database
   BUCKET: R2Bucket
+  /**
+   * This portal's own account id, stamped into wrangler.toml [vars] at assemble
+   * time by bin/portal-assemble.mjs.
+   *
+   * It is the tenant scope for every query and every object key. DB and BUCKET
+   * above are the ONE shared store that backs every portal (Task 2099), so this
+   * value is the only thing separating this client's rows and objects from
+   * another client's.
+   *
+   * Deliberately NOT taken from the session or from `people.accountId`: the
+   * people join is by ownerId, two clients may each enrol a person of the same
+   * name, and a tenant scope derived from the request would then resolve to
+   * whichever row happened to match. It is baked in at deploy time precisely so
+   * it cannot be influenced by a request.
+   */
+  PORTAL_ACCOUNT_ID: string
   /**
    * Shared with the install; signs download links for device-held files. A
    * Pages SECRET, never a var in wrangler.toml, and never sent to the client.

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/auth.ts

@@ -53,15 +53,20 @@ export async function processAuth(
   // owner: keyed on the owner alone, the counter is a weapon — six requests
   // naming a person lock that person out of their own portal for the window,
   // from anywhere, unauthenticated.
-  const scope = rateScope(ownerId, clientIp)
+  const scope = rateScope(env.PORTAL_ACCOUNT_ID, ownerId, clientIp)
   const rate = await checkAndRecordAttempt(env.DB, scope, nowMs)
   if (!rate.allowed) {
     log(`[data-portal] op=auth owner=${q(ownerId)} result=rate-limited attempts=${rate.count}`)
     return { status: 429, payload: { ok: false, error: 'too many attempts' } }
   }
 
-  const person = await env.DB.prepare('SELECT ownerId, salt, hash FROM people WHERE ownerId = ?')
-    .bind(ownerId)
+  // Scoped to this portal's own account: the people table is shared by every
+  // portal, so an ownerId-only lookup would find a same-named person belonging
+  // to another client and check the passcode against THEIR hash.
+  const person = await env.DB.prepare(
+    'SELECT ownerId, salt, hash FROM people WHERE ownerId = ? AND accountId = ?',
+  )
+    .bind(ownerId, env.PORTAL_ACCOUNT_ID)
     .first<{ ownerId: string; salt: string; hash: string }>()
 
   if (!person) {
@@ -82,7 +87,14 @@ export async function processAuth(
   await clearAttempts(env.DB, scope)
 
   const sessionId = newId()
-  await mintSession(env.DB, ownerId, sessionId, nowMs, passcodeCheck(person.hash))
+  await mintSession(
+    env.DB,
+    ownerId,
+    env.PORTAL_ACCOUNT_ID,
+    sessionId,
+    nowMs,
+    passcodeCheck(person.hash),
+  )
   log(`[data-portal] op=auth owner=${q(ownerId)} result=ok`)
   return { status: 200, payload: { ok: true }, sessionId }
 }

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/delete.ts

@@ -11,21 +11,27 @@ export async function processDelete(
   now: () => number,
 ): Promise<Handler> {
   const startedMs = now()
-  const session = await resolveSession(env.DB, sessionId, startedMs)
+  const session = await resolveSession(env.DB, sessionId, env.PORTAL_ACCOUNT_ID, startedMs)
   if (!session) {
     log('[data-portal] op=delete owner=none result=denied')
     return { status: 401, payload: { ok: false, error: 'denied' } }
   }
-  if (!authorizeKey(session.ownerId, key)) {
+  // The key arrives from the client, so the account segment is checked here and
+  // never inferred: the bucket is shared, and without it a caller could name
+  // another tenant's object outright.
+  if (!authorizeKey(env.PORTAL_ACCOUNT_ID, session.ownerId, key)) {
     log(`[data-portal] op=delete owner=${q(session.ownerId)} result=denied reason=not-owner`)
     return { status: 403, payload: { ok: false, error: 'denied' } }
   }
   const owner = q(session.ownerId)
 
   // What the client is asking to remove decides HOW it is removed, so the row
-  // is read before anything is written (Task 1910).
-  const row = await env.DB.prepare('SELECT devicePath FROM manifest WHERE objectKey = ?')
-    .bind(key)
+  // is read before anything is written (Task 1910). Every manifest statement
+  // below carries the account: objectKey is unique per account, not globally.
+  const row = await env.DB.prepare(
+    'SELECT devicePath FROM manifest WHERE objectKey = ? AND accountId = ?',
+  )
+    .bind(key, env.PORTAL_ACCOUNT_ID)
     .first<{ devicePath: string }>()
   if (!row) {
     log(`[data-portal] op=delete owner=${owner} key=${q(key)} result=absent`)
@@ -43,7 +49,11 @@ export async function processDelete(
   // minute and saying otherwise would be a lie the next refresh exposes.
   if (row.devicePath) {
     try {
-      await env.DB.prepare('UPDATE manifest SET deleted = 1 WHERE objectKey = ?').bind(key).run()
+      await env.DB.prepare(
+        'UPDATE manifest SET deleted = 1 WHERE objectKey = ? AND accountId = ?',
+      )
+        .bind(key, env.PORTAL_ACCOUNT_ID)
+        .run()
     } catch (err) {
       log(
         `[data-portal] op=withdraw owner=${owner} key=${q(key)} ` +
@@ -53,8 +63,10 @@ export async function processDelete(
     }
     // Re-read rather than assume the UPDATE landed: an unmarked row is a
     // withdrawal the pull will never see, and nothing else would report it.
-    const marked = await env.DB.prepare('SELECT deleted FROM manifest WHERE objectKey = ?')
-      .bind(key)
+    const marked = await env.DB.prepare(
+      'SELECT deleted FROM manifest WHERE objectKey = ? AND accountId = ?',
+    )
+      .bind(key, env.PORTAL_ACCOUNT_ID)
       .first<{ deleted: number }>()
     const ok = marked?.deleted === 1
     log(
@@ -84,7 +96,9 @@ export async function processDelete(
   }
 
   try {
-    await env.DB.prepare('DELETE FROM manifest WHERE objectKey = ?').bind(key).run()
+    await env.DB.prepare('DELETE FROM manifest WHERE objectKey = ? AND accountId = ?')
+      .bind(key, env.PORTAL_ACCOUNT_ID)
+      .run()
     log(`[data-portal] op=manifest-delete owner=${owner} key=${q(key)} result=ok`)
   } catch (err) {
     log(
@@ -96,8 +110,9 @@ export async function processDelete(
   // The verified post-condition: both sides re-read, not "we called delete".
   const objectPresent = (await env.BUCKET.head(key)) !== null
   const rowPresent =
-    (await env.DB.prepare('SELECT fileId FROM manifest WHERE objectKey = ?').bind(key).first()) !==
-    null
+    (await env.DB.prepare('SELECT fileId FROM manifest WHERE objectKey = ? AND accountId = ?')
+      .bind(key, env.PORTAL_ACCOUNT_ID)
+      .first()) !== null
   // Derived, never hardcoded: a failed delete printing result=ok next to
   // objectPresent=true is a self-contradicting line.
   const result = !objectPresent && !rowPresent ? 'ok' : 'incomplete'

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/download.ts

@@ -18,21 +18,25 @@ export async function processDownload(
   log: Logger,
   nowMs: number,
 ): Promise<DownloadResult> {
-  const session = await resolveSession(env.DB, sessionId, nowMs)
+  const session = await resolveSession(env.DB, sessionId, env.PORTAL_ACCOUNT_ID, nowMs)
   if (!session) {
     log('[data-portal] op=download owner=none result=denied')
     return { status: 401, payload: { ok: false, error: 'denied' } }
   }
-  // Authorize BEFORE any R2 call, so a denied caller cannot cause a fetch.
-  if (!authorizeKey(session.ownerId, key)) {
+  // Authorize BEFORE any R2 call, so a denied caller cannot cause a fetch. The
+  // key comes from the client and the bucket is shared, so the account segment
+  // is part of what is checked, never inferred from how the key was built.
+  if (!authorizeKey(env.PORTAL_ACCOUNT_ID, session.ownerId, key)) {
     log(`[data-portal] op=download owner=${q(session.ownerId)} result=denied reason=not-owner`)
     return { status: 403, payload: { ok: false, error: 'denied' } }
   }
   // Where the bytes are decides how they are served (Task 1910). A moved row's
   // R2 object has been deleted, so reading it here would 404 the client's own
   // upload the moment the device collected it.
-  const row = await env.DB.prepare('SELECT devicePath FROM manifest WHERE objectKey = ?')
-    .bind(key)
+  const row = await env.DB.prepare(
+    'SELECT devicePath FROM manifest WHERE objectKey = ? AND accountId = ?',
+  )
+    .bind(key, env.PORTAL_ACCOUNT_ID)
     .first<{ devicePath: string }>()
   if (!row) {
     log(`[data-portal] op=download owner=${q(session.ownerId)} result=absent`)
@@ -53,7 +57,7 @@ export async function processDownload(
     const url = await buildOwnUploadUrl(
       origin,
       secret,
-      session.accountId,
+      env.PORTAL_ACCOUNT_ID,
       session.ownerId,
       row.devicePath,
       expiresAt,
@@ -106,12 +110,12 @@ export async function processIndexedDownload(
   nowMs: number,
   fetchFn: HeadFetch,
 ): Promise<IndexedDownloadResult> {
-  const session = await resolveSession(env.DB, sessionId, nowMs)
+  const session = await resolveSession(env.DB, sessionId, env.PORTAL_ACCOUNT_ID, nowMs)
   if (!session) {
     log('[data-portal] op=fetch-through owner=none result=denied')
     return { status: 401, payload: { ok: false, error: 'denied' } }
   }
-  if (!session.accountId) {
+  if (!env.PORTAL_ACCOUNT_ID) {
     log(`[data-portal] op=fetch-through owner=${q(session.ownerId)} result=no-account`)
     return { status: 404, payload: { ok: false, error: 'not found' } }
   }
@@ -135,7 +139,7 @@ export async function processIndexedDownload(
          ON s.accountId = d.accountId AND s.currentGeneration = d.generation
       WHERE d.accountId = ? AND d.relPath = ?`,
   )
-    .bind(session.accountId, relPath)
+    .bind(env.PORTAL_ACCOUNT_ID, relPath)
     .first<{ relPath: string; isDir: number }>()
   if (!row) {
     log(
@@ -165,7 +169,7 @@ export async function processIndexedDownload(
   }
 
   const expiresAt = nowMs + SIGNED_TTL_MS
-  const url = await buildSignedUrl(origin, secret, session.accountId, relPath, expiresAt)
+  const url = await buildSignedUrl(origin, secret, env.PORTAL_ACCOUNT_ID, relPath, expiresAt)
 
   const started = Date.now()
   try {

package/payload/platform/plugins/cloudflare/skills/data-portal/template/functions/api/files.ts

@@ -114,31 +114,35 @@ export async function processFiles(
   nowMs: number,
   prefix = '',
 ): Promise<Handler> {
-  const session = await resolveSession(env.DB, sessionId, nowMs)
+  const session = await resolveSession(env.DB, sessionId, env.PORTAL_ACCOUNT_ID, nowMs)
   if (!session) {
     log('[data-portal] op=list owner=none result=denied')
     return { status: 401, payload: { ok: false, error: 'denied' } }
   }
-  // Scoped by ownerId, not by key prefix: the owner is the authority.
+  // Scoped by account AND owner, not by key prefix: the owner is the authority
+  // for which files, the account for whose. The manifest is shared by every
+  // portal, so an owner-only filter would list a same-named person's uploads
+  // from another client outright.
   const rows = await env.DB.prepare(
     'SELECT fileId, filename, objectKey, size, uploadedAt, ingested, targetPath, devicePath, deleted ' +
-      'FROM manifest WHERE ownerId = ? ORDER BY uploadedAt DESC',
+      'FROM manifest WHERE accountId = ? AND ownerId = ? ORDER BY uploadedAt DESC',
   )
-    .bind(session.ownerId)
+    .bind(env.PORTAL_ACCOUNT_ID, session.ownerId)
     .all<Record<string, unknown>>()
   const allFiles = rows.results ?? []
 
   // The account's published folder index, scoped by accountId and read through
-  // the generation pointer so a push in flight is never half-visible. No
-  // account bound means no folders: an enrolment predating that column lands
-  // here, and the empty `account=` field in the log line is what says so.
+  // the generation pointer so a push in flight is never half-visible. Bound to
+  // the portal's own account rather than the session's: resolveSession already
+  // requires the two to agree, and binding the baked-in value keeps the tenant
+  // scope independent of anything a request can influence.
   let entries: DirEntry[] = []
   const grant = session.folders
   // The tops the client can actually browse. Built from the SAME grant-filtered
   // rows the tree is built from, so the uploads panel and the tree can never
   // disagree about what is reachable.
   const visibleTops = new Set<string>()
-  if (session.accountId) {
+  if (env.PORTAL_ACCOUNT_ID) {
     const dir = await env.DB.prepare(
       `SELECT d.relPath AS relPath, d.sizeBytes AS sizeBytes, d.modifiedAt AS modifiedAt,
               d.isDir AS isDir
@@ -147,7 +151,7 @@ export async function processFiles(
            ON s.accountId = d.accountId AND s.currentGeneration = d.generation
         WHERE d.accountId = ?`,
     )
-      .bind(session.accountId)
+      .bind(env.PORTAL_ACCOUNT_ID)
       .all<DirRow>()
     // The grant narrows below the account's exposed set: keep only rows the
     // grant admits. An empty grant admits everything, which is the full set and