Vendor Portal: Upload Safety and Webhook Security
Multiple fixes to make vendor uploads and SFTP integrations more reliable.
- Atomic uploads: asset creation and product-slot linking now happen in one transaction. If something fails, the uploaded file is cleaned up instead of leaving orphaned data.
- SFTP webhook auth fails closed when the secret key is missing, so misconfigured servers reject unsigned events instead of accepting them
- Upload validation uses a single ranged-read path instead of separate checks, with proper fallback when storage providers skip size metadata
- SFTPGo admin calls now retry on transient failures and refresh stale auth tokens automatically