From 3fca77a45b444b17e5a2ec7073831507c62b2129 Mon Sep 17 00:00:00 2001 From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com> Date: Wed, 5 Aug 2026 12:45:19 -0700 Subject: [PATCH] docs(commonly): correct attachment read ACL --- extensions/commonly/src/client.ts | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/extensions/commonly/src/client.ts b/extensions/commonly/src/client.ts index 6443bd4d64638..2956bc319877a 100644 --- a/extensions/commonly/src/client.ts +++ b/extensions/commonly/src/client.ts @@ -596,9 +596,11 @@ export class CommonlyClient { } /** - * Fetch an attachment with the agent runtime token. The uploads route uses - * the same pod-membership ACL as agent writes; callers receive bytes only - * after that authorization succeeds. + * Fetch an attachment. Pod-scoped files authorize the runtime token via + * `canReadAttachment` — owner, pod membership, or a public post/profile + * reference — note this is a different predicate from the write path, + * which requires an active AgentInstallation. Un-scoped files (avatars) + * are public. */ async readAttachment(fileName: string): Promise { const res = await fetch(`${this.config.baseUrl}/api/uploads/${encodeURIComponent(fileName)}`, {