[Bug]: Authenticated image owners cannot retrieve hidden metadata or original uploaded file via API

What happened?

When an image is uploaded to CivitAI with prompt/metadata visibility enabled, the REST API returns the image metadata correctly and the returned image URL can be used to retrieve the original image including its embedded generation metadata.

However, once hideMeta is enabled for the image, this behavior changes even for the authenticated owner of the image.

When accessing my own image using a valid CivitAI API token:

• withMeta=true no longer returns the image metadata.
• The image URL no longer provides the original uploaded file.
• An originally uploaded PNG is returned through the delivery path as a JPEG without the original embedded metadata.

This behavior makes sense for anonymous users and other users, because hideMeta is intended to prevent them from retrieving the prompt/generation metadata.

The problem is that the same restriction is also applied to the authenticated owner of the image. The API already knows who the requester is through the API token, but ownership is currently not taken into account when hideMeta is applied.

As a result, enabling metadata privacy also removes the owner's ability to retrieve their own original uploaded file and metadata through the REST API.

Steps to reproduce the problem

1. Upload a PNG image containing embedded generation metadata to CivitAI.

2. Leave prompt/metadata visibility enabled.

3. Query the image through the REST API using the owner's API token, for example:

   GET /api/v1/images?imageId=<IMAGE_ID>&withMeta=true

   with:

   Authorization: Bearer <API_TOKEN>

4. Verify that the API returns the metadata and download the URL returned for the image.

5. Verify that the downloaded image still contains the expected original metadata.

6. Enable "Hide metadata / prompt" for the same image.

7. Repeat the same authenticated API request with the same owner API token.

8. Observe that the metadata is now null/missing.

9. Download the returned image URL again.

10. Observe that the returned file is a sanitized delivery copy rather than the original uploaded file. For example, an original PNG may be returned as JPEG and no longer contains the original embedded metadata.

The important part is that this happens even though the request is authenticated as the user who owns the image.

What should have happened?

hideMeta should control public access to the metadata, not remove the owner's access to their own uploaded data and original file.

Anonymous users and users who do not own the image should continue receiving the current sanitized response when hideMeta=true.

However, an authenticated owner should have an API-supported way to retrieve:

• the original uploaded file without transcoding or metadata stripping;
• the stored generation metadata;
• the original MIME type / filename where available.

This should only be available after verifying that:

image.userId === authenticatedUser.id

The existing public image URL does not need to change and should remain privacy-safe and cacheable.

What platforms do you use to access the site?

Other/Cloud

What browsers do you use to access the site?

Not browser-specific. This affects REST API clients.

Additional information, context and logs

I looked through the current implementation and the behavior appears to come from the way hideMeta is applied globally rather than based on the requesting user.

Metadata

The REST API authenticates API/Bearer tokens and has access to session.user:

src/server/auth/get-server-auth-session.ts

The image endpoint also passes the authenticated user into the image search path:

src/pages/api/v1/images/index.ts

However, metadata retrieval eventually uses imageMetaCache, which currently performs a query equivalent to:

CASE
  WHEN i."hideMeta" = TRUE THEN NULL
  ELSE i.meta
END

This is located in:

src/server/redis/caches.ts

There is no requester/owner check at this point, so hideMeta=true causes the metadata to be hidden from the owner as well.

Original image delivery

The REST response constructs the image URL using:

getEdgeUrl(image.url, {
  original: true,
  type: image.type,
})

in:

src/server/services/image-search.service.ts

This still routes through the image delivery infrastructure.

The delivery metadata lookup only contains information such as:

{
  id,
  url,
  hideMeta,
  type,
  mimeType
}

and does not know which CivitAI user requested the image.

Relevant files:

• src/server/services/image-delivery.service.ts
• src/pages/api/internal/image-delivery/[id].ts

Because the delivery layer only sees hideMeta, it cannot distinguish between:

• an anonymous visitor;
• another authenticated user;
• the owner of the image.

This means the normal delivery path cannot safely provide owner-specific original files without changing its caching/authentication model.

Suggested solution

Keep the existing public image delivery behavior unchanged, but provide an authenticated owner-only API path for retrieving the original uploaded asset and its metadata.

For example:

GET /api/v1/images/<IMAGE_ID>/original
Authorization: Bearer <API_TOKEN>

After verifying image ownership, this endpoint could return the original stored file (or a short-lived signed URL) together with the unfiltered metadata.

This would keep hideMeta effective for public/non-owner requests without preventing the owner from accessing their own original upload.

• No change to the current public privacy behavior.
• No risk of a CDN cache serving owner-only metadata to another user.
• hideMeta=true remains safe for all public/non-owner requests.
• Owners retain access to their own original uploaded files.
• Original PNG/WebP/etc. files do not need to be converted to JPEG.
• Existing API-token authentication and MediaRead permissions can be reused.

The regular public url could therefore remain unchanged, while the new authenticated endpoint explicitly provides owner-only access to the original asset and metadata.