refactor: reuse access token scope helper for direct uploads

app/controllers/api/v1/accounts/conversations/direct_uploads_controller.rb

@@ -1,5 +1,7 @@
 class Api::V1::Accounts::Conversations::DirectUploadsController < ActiveStorage::DirectUploadsController
   include EnsureCurrentAccountHelper
+  include AccessTokenAuthHelper
+  before_action :prevent_read_only_access_token!
   before_action :current_account
   before_action :conversation
 

app/controllers/concerns/access_token_auth_helper.rb

@@ -36,4 +36,15 @@ module AccessTokenAuthHelper
   def agent_bot_accessible?
     BOT_ACCESSIBLE_ENDPOINTS.fetch(params[:controller], []).include?(params[:action])
   end
+
+  # Blocks read-only access tokens from reaching write endpoints that live outside
+  # Api::BaseController (e.g. controllers inheriting from ActiveStorage). Resolves
+  # the token directly since these controllers skip the Api::BaseController chain.
+  def prevent_read_only_access_token!
+    ensure_access_token
+    return unless @access_token&.scope == 'read_only'
+
+    render json: { error: 'This access token is read-only and cannot perform write operations.' },
+           status: :forbidden
+  end
 end