From 185629a4c47c23a553ce3cd826f310534111cc40 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=EC=9C=A0=EC=B0=BD=EC=9A=B1?= Date: Sun, 12 Jul 2026 00:07:42 +0900 Subject: [PATCH] fix(cloud): unify ingest auth errors (anti-enumeration) + guard snapshot write --- cloud/src/Ingest/IngestController.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cloud/src/Ingest/IngestController.php b/cloud/src/Ingest/IngestController.php index bc9f8ed..18d35aa 100644 --- a/cloud/src/Ingest/IngestController.php +++ b/cloud/src/Ingest/IngestController.php @@ -36,13 +36,13 @@ final class IngestController return Response::json(['error' => 'unauthorized'], 401); } if (!Hmac::verify($secret, $nonce, $ts, $req->body(), $sig)) { - return Response::json(['error' => 'bad_signature'], 401); + return Response::json(['error' => 'unauthorized'], 401); } if (abs($now - (int)(float)$ts) > $this->cfg->timestampWindow()) { - return Response::json(['error' => 'stale_timestamp'], 401); + return Response::json(['error' => 'unauthorized'], 401); } if ($this->nonces->seen($nonce)) { - return Response::json(['error' => 'replay'], 401); + return Response::json(['error' => 'unauthorized'], 401); } $this->nonces->remember($nonce, $now + $this->cfg->nonceTtl()); @@ -54,7 +54,7 @@ final class IngestController $img = ImageProcessor::reencode((string)$b64); if (!$img['ok']) continue; $path = rtrim($this->cfg->snapshotDir(), '/\\') . '/' . $img['uuid'] . '.jpg'; - file_put_contents($path, $img['bytes']); + if (file_put_contents($path, $img['bytes']) === false) continue; $this->snapshots->add($eventId, $img['uuid'], $img['hash']); } return Response::json(['event_id' => $eventId], 201);