- status_message: str | Field(...) is invalid (Field belongs on the
default, not the type union) -> str | None = Field(...)
- router called is_online(ids) with a list and treated the bool result
as a collection (uid in online_ids would TypeError on the first real
call) -> added is_online_batch() using MGET, one round trip, tested
against a live Redis instance
Requesting an explicit ?visibility=PRIVATE (or FRIENDS_ONLY) skipped the
ownership check entirely — any authenticated user could list every other
user's private worlds just by passing the filter. Only the no-filter
default path enforced ownership. Now the ownership check applies whenever
a non-PUBLIC visibility is requested, explicit or not.
Also fixed current_user: CurrentUser = Depends() in assets.py (redundant
empty Depends() on an already-Annotated dependency, inconsistent with
every other endpoint) to plain current_user: CurrentUser per the review
feedback, and reordered params since that made it a non-default arg
following a defaulted one (SyntaxError otherwise).
Verified: py_compile clean, full app imports and loads in a clean venv.
coder-bot
coder-bot
agent-bot