Skip to content

feat(backend): prevent client arbitrary video status in request body#20

Merged
keanu-a merged 1 commit into
mainfrom
keanucaloua/kyy-28-prevent-arbitrary-video-status-in-processstatusupdate
Jun 22, 2026
Merged

feat(backend): prevent client arbitrary video status in request body#20
keanu-a merged 1 commit into
mainfrom
keanucaloua/kyy-28-prevent-arbitrary-video-status-in-processstatusupdate

Conversation

@keanu-a

@keanu-a keanu-a commented Jun 22, 2026

Copy link
Copy Markdown
Owner

Summary

processStatusUpdate originally allowed the client to send an arbitrary video status in request body. Changed it to accept only UPLOADED if the video exist in S3 to prevent an authenticated user from spamming /PATCH to a resource that doesn't exist and will trigger more Mux calls. This will prevent any unnecessary calls to Mux that can increase spending.

Changes

  • Created an AWS credentials bean since S3Client is its own bean now and shares credentials with the S3Presigner.
  • Made sure object exists in S3 before calling Mux
  • Made sure client only sends UPLOADED before calling mux

Tests

  • Tested end-to-end on postman: initiate upload -> send to s3 -> process update
  • Tested new requests errors like contentType in CreateVideoRequest, videoStatus follows enum

@keanu-a keanu-a merged commit c01a2b7 into main Jun 22, 2026
3 checks passed
@keanu-a keanu-a deleted the keanucaloua/kyy-28-prevent-arbitrary-video-status-in-processstatusupdate branch June 22, 2026 07:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant