JSLMPR e18c2cd9a9 • I completed the next plan step and updated the plan. Security review is now marked done in docs/video-clipping-service-implementation-plan.md:701. ... The security hardening I implemented was tenant isolation across the API surface. X-Tenant-Id is now enforced on asset reads, upload completion, asset/job event reads, clip listing, job reads, cancellation, deletion, and signed download URL creation. Cross-tenant access returns 403 via the new src/main/java/org/example/videoclips/application/ForbiddenException.java:1 and handler wiring in src/main/java/org/example/videoclips/api/ ApiExceptionHandler.java:1. I also stopped exposing providerUploadId from the upload-session read response in src/main/java/org/example/videoclips/application/VideoAssetService.java:224, since that provider identifier is internal metadata. Verification: mvn -q test passed. - TenantQuotaControllerTest: 1/1 - VideoAssetControllerTest: 11/11 - RetentionCleanupJobTest: 2/2 - DatabaseBackedClipJobQueueAdapterTest: 2/2 The production-hardening section of the plan is now fully checked off.		2026-07-09 01:19:43 +02:00
..
video-clipping-service-implementation-plan.md	• I completed the next plan step and updated the plan. Security review is now marked done in docs/video-clipping-service-implementation-plan.md:701.	2026-07-09 01:19:43 +02:00
video-clipping-service-planning-prompt.md	initial	2026-07-08 17:00:58 +02:00