Harden Uploads and Resource Ownership

Task

Audit every Book-related resource boundary.

For each operation, verify ownership on the server:

where: {
  id: resourceId,
  userId: user.id,
}

Apply the rule to:

• Books
• ReadingProgress
• Bookmarks
• Highlights
• Notes
• ReaderPreferences where applicable

For uploads, enforce:

• authenticated user
• file size limit
• EPUB extension/type validation
• controlled storage key generation
• server-only storage credentials
• cleanup after partial failures

Never let a client choose an arbitrary storage key.

Test

Create two accounts and try to access or mutate each other’s:

• Book
• progress
• bookmark
• Highlight
• Note

Also test invalid and oversized uploads.

Checkpoint

Readly’s resource APIs consistently enforce authentication and ownership instead of trusting browser-supplied IDs.