Status: Current controls + next hardening

Authentication boundaries

Normal application routes use Clerk-backed authentication.

The Vapi tool endpoint is a special server-to-server boundary because the request originates from Vapi rather than a browser session.

It therefore checks:

1. Static Vapi secret.
2. HMAC-signed document token.

This separates caller authentication from document authorization.

Signed document token

The token binds:

pdfId + userId + expiresAt

to a server-generated signature.

The tool route verifies the signature and expiry before using document identity. A caller-supplied pdfId is not treated as the authority for document access.

Blob deletion safety

Authenticated deletion

The normal deletion route verifies the user and ownership, removes application records/segments, and deletes the associated Blob asset.

Upload-failure cleanup

The orphan cleanup route is narrower and scopes deletion to the current user's Blob namespace. It exists specifically for the case where a Blob object was created before database metadata was successfully persisted.