JSLMPR e18c2cd9a9 • I completed the next plan step and updated the plan. Security review is now marked done in docs/video-clipping-service-implementation-plan.md:701. ... The security hardening I implemented was tenant isolation across the API surface. X-Tenant-Id is now enforced on asset reads, upload completion, asset/job event reads, clip listing, job reads, cancellation, deletion, and signed download URL creation. Cross-tenant access returns 403 via the new src/main/java/org/example/videoclips/application/ForbiddenException.java:1 and handler wiring in src/main/java/org/example/videoclips/api/ ApiExceptionHandler.java:1. I also stopped exposing providerUploadId from the upload-session read response in src/main/java/org/example/videoclips/application/VideoAssetService.java:224, since that provider identifier is internal metadata. Verification: mvn -q test passed. - TenantQuotaControllerTest: 1/1 - VideoAssetControllerTest: 11/11 - RetentionCleanupJobTest: 2/2 - DatabaseBackedClipJobQueueAdapterTest: 2/2 The production-hardening section of the plan is now fully checked off.		2026-07-09 01:19:43 +02:00
.idea	initial	2026-07-08 17:00:58 +02:00
docs	• I completed the next plan step and updated the plan. Security review is now marked done in docs/video-clipping-service-implementation-plan.md:701.	2026-07-09 01:19:43 +02:00
src	• I completed the next plan step and updated the plan. Security review is now marked done in docs/video-clipping-service-implementation-plan.md:701.	2026-07-09 01:19:43 +02:00
tmp	I completed the next plan step, Tenant quotas, and updated the plan to mark it done in docs/video-clipping-service-implementation-plan.md:701.	2026-07-09 01:07:07 +02:00
.gitignore	initial	2026-07-08 17:00:58 +02:00
pom.xml	The storage port now has an opt-in S3-compatible implementation in src/main/java/org/example/videoclips/storage/S3ObjectStorageAdapter.java. It uses the AWS SDK presigner to generate multipart	2026-07-08 23:47:05 +02:00