CS-429 [Bug] - Attempt to upload meeting evidence showing a 401 Unauthorized error

[github-actions]

This is an automated pull request to merge chas/upload-submission-authorization into dev.
It was created by the [Auto Pull Request] action.

---

Summary by cubic

Fixes CS-429 by enabling session, API key, or service token auth for evidence uploads and attributing each submission to a resolved user. Prevents 401s and returns 400 when no org owner exists.

• New Features

  • uploadSubmission accepts session, API key, or service token auth.
  • Attributes to the session user, else the org’s oldest owner for API key/service token.
  • Returns 400 when no owner can be found.

• Refactors

  • Controller uses ActingUserResolver to resolve the acting user from req and passes userId to the service.
  • Service uploadSubmission now takes userId instead of authContext.

^{Written for commit 0e9333f. Summary will update on new commits.}

Review in cubic

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
app	Ready	Preview, Comment	May 28, 2026 4:48pm
comp-framework-editor	Ready	Preview, Comment	May 28, 2026 4:48pm
portal	Ready	Preview, Comment	May 28, 2026 4:48pm

[linear]

CS-429

[cubic-dev-ai]

No issues found across 3 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}