fix: reject dangling file attachment links

server/db/mysql/adapter.go

@@ -5135,16 +5135,27 @@ func (a *adapter) FileLinkAttachments(topic string, userId, msgId t.Uid, fids []
 		}
 		dids = append(dids, store.DecodeUid(id))
 	}
+	var existing int
+	query, queryArgs, err := sqlx.In("SELECT COUNT(*) FROM im_fileuploads WHERE id IN (?) AND status=?", dids, t.UploadCompleted)
+	if err != nil {
+		return err
+	}
+	ctx, cancel := a.getContextForTx()
+	if cancel != nil {
+		defer cancel()
+	}
+	if err = a.db.GetContext(ctx, &existing, a.db.Rebind(query), queryArgs...); err != nil {
+		return err
+	}
+	if existing != len(dids) {
+		return t.ErrNotFound
+	}
 
 	for _, id := range dids {
 		// createdat,fileid,[msgid|topic|userid]
 		args = append(args, now, id, linkId)
 	}
 
-	ctx, cancel := a.getContextForTx()
-	if cancel != nil {
-		defer cancel()
-	}
 	tx, err := a.db.BeginTxx(ctx, nil)
 	if err != nil {
 		return err

server/db/mysql/tenant_adapter.go

@@ -7801,17 +7801,31 @@ func (a *adapter) TenantFileLinkAttachments(id t.TenantID, topic string, userID,
 		fids = fids[:1]
 	}
 	var args []any
+	var dids []any
 	for _, fid := range fids {
 		fileID := t.ParseUid(fid)
 		if fileID.IsZero() {
 			return t.ErrMalformed
 		}
-		args = append(args, id, now, decodeUID(fileID), linkID)
+		decoded := decodeUID(fileID)
+		dids = append(dids, decoded)
+		args = append(args, id, now, decoded, linkID)
 	}
 	ctx, cancel := a.getContextForTx()
 	if cancel != nil {
 		defer cancel()
 	}
+	var existing int
+	query, queryArgs, err := sqlx.In("SELECT COUNT(*) FROM im_fileuploads WHERE tenant_id=? AND id IN (?) AND status=?", id, dids, t.UploadCompleted)
+	if err != nil {
+		return err
+	}
+	if err = a.db.GetContext(ctx, &existing, a.db.Rebind(query), queryArgs...); err != nil {
+		return err
+	}
+	if existing != len(dids) {
+		return t.ErrNotFound
+	}
 	tx, err := a.db.BeginTxx(ctx, nil)
 	if err != nil {
 		return err