Make asset mime_type immutable after first ingest

Prevents cross-tenant metadata mutation when multiple references share
the same content-addressed Asset row. mime_type can now only be set when
NULL (first ingest); subsequent attempts to change it are silently ignored.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/assets/database/queries/asset.py

@@ -69,7 +69,7 @@ def upsert_asset(
         if asset.size_bytes != int(size_bytes) and int(size_bytes) > 0:
             asset.size_bytes = int(size_bytes)
             changed = True
-        if mime_type and asset.mime_type != mime_type:
+        if mime_type and not asset.mime_type:
             asset.mime_type = mime_type
             changed = True
         if changed:
@@ -118,7 +118,7 @@ def update_asset_hash_and_mime(
         return False
     if asset_hash is not None:
         asset.hash = asset_hash
-    if mime_type is not None:
+    if mime_type is not None and not asset.mime_type:
         asset.mime_type = mime_type
     return True
 

app/assets/services/asset_management.py

@@ -108,10 +108,11 @@ def update_asset_metadata(
             touched = True
 
         if mime_type is not None:
-            update_asset_hash_and_mime(
+            updated = update_asset_hash_and_mime(
                 session, asset_id=ref.asset_id, mime_type=mime_type
             )
-            touched = True
+            if updated:
+                touched = True
 
         if preview_id is not None:
             set_reference_preview(

app/assets/services/ingest.py

@@ -146,7 +146,7 @@ def _register_existing_asset(
         if not asset:
             raise ValueError(f"No asset with hash {asset_hash}")
 
-        if mime_type and asset.mime_type != mime_type:
+        if mime_type and not asset.mime_type:
             update_asset_hash_and_mime(session, asset_id=asset.id, mime_type=mime_type)
 
         if preview_id: