app/controllers/api/storage.php (1)

1511-1571: Deriving Content‑Disposition from JWT is correct; consider whitelisting values

Using a JWT claim to drive Content-Disposition and defaulting to inline preserves existing behavior and lets CSV exports opt into attachment, which looks good.

To harden this a bit and avoid unexpected or malformed dispositions from any future issuer of these JWTs, you could constrain the value to a small allow‑list before using it in the header, e.g.:

-    $isInternal = $decoded['internal'] ?? false;
-    $disposition = $decoded['disposition'] ?? 'inline';
+    $isInternal = $decoded['internal'] ?? false;
+    $disposition = $decoded['disposition'] ?? 'inline';
+    $allowedDispositions = ['inline', 'attachment'];
+    if (!\in_array($disposition, $allowedDispositions, true)) {
+        $disposition = 'inline';
+    }

Header construction can remain as is:

->addHeader('Content-Disposition', $disposition . '; filename="' . $file->getAttribute('name', '') . '"')

This keeps the new feature but prevents accidental introduction of odd or invalid disposition tokens.

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro