CS-429 [Bug] - Attempt to upload meeting evidence showing a 401 Unauthorized error

[github-actions]

This is an automated pull request to merge chas/upload-submission-authorization into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Fixes CS-429 by allowing session, API key, or service token auth for evidence uploads and attributing each submission to an active user. Stops 401s on upload, blocks attribution to deactivated owners, and returns 400 when no active org owner exists.

• New Features

  • uploadSubmission accepts session, API key, or service token auth.
  • Attributes to the session user; for API key/service token, falls back to the org’s oldest active owner (deactivated/inactive owners are excluded).
  • Returns 400 (BadRequest) when no active owner can be found.

• Refactors

  • Controller uses ActingUserResolver with @Req to resolve the acting user and passes userId to the service.
  • Service uploadSubmission now takes userId instead of authContext.

^{Written for commit ec6a1fa. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
comp-framework-editor	Ready	Preview, Comment	Jun 1, 2026 7:12pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
app	Skipped		Jun 1, 2026 7:12pm
portal	Skipped		Jun 1, 2026 7:12pm

[linear]

CS-429

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[chasprowebdev]

@cubic-dev-ai Ultrareview

[cubic-dev-ai]

@cubic-dev-ai Ultrareview

@chasprowebdev Starting ultrareview - a deeper analysis than a regular review. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 5m 26s

2 issues found across 3 files

Confidence score: 3/5

• There is a concrete user-impact risk in apps/api/src/evidence-forms/evidence-forms.controller.ts: attribution fallback is tied to a hardcoded owner role name rather than RBAC permissions, which can incorrectly reject valid org configurations with 400 responses.
• A second moderate issue in the same controller allows fallback attribution to deactivated members because active-membership filtering is not enforced, which can misattribute uploads.
• Given the medium severity and solid confidence on both findings, this looks mergeable only with caution until attribution fallback logic is aligned with RBAC and active-user checks.
• Pay close attention to apps/api/src/evidence-forms/evidence-forms.controller.ts - fallback attribution can reject valid permissioned setups and assign uploads to inactive members.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[chasprowebdev]

@cubic-dev-ai Ultrareview

[cubic-dev-ai]

@cubic-dev-ai Ultrareview

@chasprowebdev Starting ultrareview - a deeper analysis than a regular review. I'll post findings when complete.

[cubic-dev-ai]

Ultrareview completed in 5m 27s

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[tofikwest]

approved

[claudfuen]

🎉 This PR is included in version 3.66.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀