Security issue when someone can just upload via rest api

[saarmornel]

anyone can upload anything with fake id and there is no validation that there is video document with this id.
the same thing apply for Video microservice when anyone can create a document without uploading anything...

[saarmornel]

I suggest to create a new pending document via Axios request from the uploader, and then to find a way to return the id in the beginning of the upload(maybe the event of the first response will be with the id)

Alternatively, we could just check in the biginning of the upload if there is a document as this via Axios.

[saarmornel]

there is better solution: when Video MS fail to update the video because either user doesn't have permission or there is no id, then he send back message to uploader to delete the file.