Fix canonical archive writes and retain scoped lifecycle evidence

2026-11-07 22:34:42 +08:00
parent b85e8bd2ca
commit 12458e10dc
5 changed files with 118 additions and 22 deletions
@@ -76,7 +76,7 @@ func (s *service) protected(callbacks map[string]string, handle endpoint) http.H
 		}
 		if r.Method == http.MethodOptions {
 			w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PATCH, DELETE, OPTIONS")
-			w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-Match, Idempotency-Key")
+			w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, If-Match, Idempotency-Key, X-Expected-Account")
 			reply(w, 204, nil)
 			return
 		}
@@ -88,6 +88,10 @@ func (s *service) protected(callbacks map[string]string, handle endpoint) http.H
 		account := session.AccountID
 		if err == nil {
 			auth.WriteSessionHeaders(w, session)
+			if expected := r.Header.Get("X-Expected-Account"); expected != "" && expected != account {
+				reject(w, 409, "identity_changed")
+				return
+			}
 		}
 		if err == nil && r.PathValue("workspace") != "" {
 			var id string