2 Commits

Author	SHA1	Message	Date
Rosa Gutierrez	f66a2dc1ba	Consider user avatars always public ... Avatars are purposely accessible without authentication (5e3b5b6d7c) because they can be in public collections. Trying to restrict this by checking whether they're in fact present in some public collection is rather expensive, so let's keep them public.	2025-12-26 19:33:26 +01:00
Rosa Gutierrez	196d685f8d	Implement authorization for Active Storage endpoints ... Consider blobs attached to any public records accessible to anyone with the URL.	2025-12-25 21:22:36 +01:00