2 Commits

Author	SHA1	Message	Date
daniel-c-harvey	558ff4b4c6	fix: close TOCTOU in CREATE path; add anti-forgery, loose-track, and case-sensitivity tests ... FindOrCreateRelease now returns (ReleaseDto, bool WasCreated); the CREATE path in UploadAsync rejects WasCreated=false as a duplicate rather than silently attaching on a lost race.	2026-06-19 15:55:08 -04:00
daniel-c-harvey	bd85507308	Block duplicate-release uploads by (title, artist): pre-flight check + server 409 backstop, with within-batch Cut attach via releaseId	2026-06-19 15:44:41 -04:00