Find the trust-boundary flaw in this direct-upload completion handler.
JavaScript
async function completeUpload(id, body, actor, db) {
const record = await db.files.find(id);
if (record.ownerId !== actor.id) throw new Error('forbidden');
await db.files.update(id, {
status: 'available',
size: body.size,
contentType: body.contentType,
checksum: body.sha256,
});
return { id, status: 'available' };
}