v1.6.3: fix project file upload, filter responsible user by permission

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/project-files.ts

@@ -156,7 +156,6 @@ export default async function projectFilesRoutes(
     "/upload",
     {
       preHandler: requirePermission("projects.files"),
-      bodyLimit: config.nas.maxUploadSize,
     },
     async (request, reply) => {
       const parsedQuery = parseProjectFilesQuery(request.query);
@@ -183,13 +182,25 @@ export default async function projectFilesRoutes(
       const rawFileName = file.filename;
       const fileName = rawFileName.replace(/[\/\\:*?"<>|]/g, "_");
 
+      const buffer = await file.toBuffer();
       const err = await fm.uploadFile(
         project.project_number,
         subPath,
-        file.file,
+        buffer,
         fileName,
       );
-      if (err !== null) return error(reply, err);
+      if (err !== null) {
+        request.log.error(
+          {
+            err,
+            project_number: project.project_number,
+            subPath,
+            fileName,
+          },
+          "uploadFile failed",
+        );
+        return error(reply, err);
+      }
 
       await logAudit({
         request,

src/routes/admin/users.ts

@@ -22,8 +22,12 @@ export default async function usersRoutes(
     "/",
     { preHandler: requirePermission("users.view") },
     async (request, reply) => {
-      const params = parsePagination(request.query as Record<string, unknown>);
-      const result = await listUsers(params);
+      const query = request.query as Record<string, unknown>;
+      const params = parsePagination(query);
+      const permission = query.permission
+        ? String(query.permission)
+        : undefined;
+      const result = await listUsers({ ...params, permission });
 
       return paginated(
         reply,