Whether r2ObjectKey is under this user's presigned staging prefix.
Keys are created by generateObjectKey in app/api/uploads/presign/route.ts:
temp/uploads/{userId}/{timestamp}-{uuid}/{sanitizedFilename}.
Rejects path traversal (.., backslashes) and userIds containing separators so
temp/uploads/../other/ style keys cannot satisfy the check.
Whether
r2ObjectKeyis under this user's presigned staging prefix. Keys are created bygenerateObjectKeyinapp/api/uploads/presign/route.ts:temp/uploads/{userId}/{timestamp}-{uuid}/{sanitizedFilename}.Rejects path traversal (
.., backslashes) and userIds containing separators sotemp/uploads/../other/style keys cannot satisfy the check.