Address response bodies by response id instead of a filesystem path

Browse Source

The body commands took a path from the client, so a token holder could
read any file the process could. They now take a response id and resolve
the location themselves, and the UI never sees a path at all: the desktop
host asks the backend where the file is, and the bridge fetches
/responses/:id/body.

Ephemeral responses (GraphQL introspection) never reach the database, so
resolution falls back to the path send writes them to.

...

This commit is contained in:

Gregory Schier

2026-08-14 17:02:05 -07:00

parent 99a318224f

commit 448d349af8

18 changed files with 366 additions and 110 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

crates-tauri/yaak-app-client/bindings/gen_rpc.ts

Generated

+5 -3

File diff suppressed because one or more lines are too long