feat(api): let download verify the file starts with an expected signature - #152
Open
arminfauland wants to merge 1 commit into
Open
feat(api): let download verify the file starts with an expected signature#152arminfauland wants to merge 1 commit into
arminfauland wants to merge 1 commit into
Conversation
…ture
When a session expires or a bot check kicks in, the other side usually
answers with HTTP 200 and an HTML page rather than an error status. The
download action wrote that page under the requested name, producing an
"invoice.pdf" whose content is "<!DOCTYPE html>". Downstream processing
notices late or not at all — in our case three such files reached a
document management system before anyone spotted them.
Adds an optional `expectMagic` parameter:
"params": {
"url": "…",
"path": "./downloads",
"filename": "invoice.pdf",
"expectMagic": "%PDF"
}
If the content does not start with the given signature, the file is not
written, the actual bytes are logged, and the action returns null so a
skipIf can react. Both download paths are covered — the remote fetch and
the local file:// copy, where only the first bytes are read rather than
the whole file.
Without the parameter behaviour is unchanged, so existing configurations
are unaffected.
Tests: 4 new cases (match, mismatch, parameter absent, local file).
Docs: parameter table and a section in EN and DE.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LixHBPkhb8h5oDdMqSG4se
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When a session expires or a bot check kicks in, the other side usually answers with HTTP 200 and an HTML page rather than an error status.
response.okis true, the buffer is non-empty, so the download action happily writes it under the requested name.The result is an
invoice.pdfwhose content is<!DOCTYPE html><html>…. Nothing in the pipeline notices — in my case three such files reached a document management system and were only found days later by hand.Solution
An optional
expectMagicparameter:{ "action": "download", "params": { "url": "{{previousData.invoiceUrl}}", "path": "./downloads", "filename": "invoice-{{previousData.orderId}}.pdf", "expectMagic": "%PDF" } }If the content does not start with that signature, the file is not written, the action logs what it actually received, and returns
null— so askipIfcan react to it.Both write paths are covered:
writeFileSyncfile://copy — only the first bytes are read viaopenSync/readSync, not the whole fileWithout the parameter nothing changes, so existing configurations are unaffected. That is covered by a test rather than just asserted.
Tests
4 new cases in
download.action.spec.ts:%PDFnull, error loggedexpectMagicabsent, HTML contentnullnx lint apiclean, full API suite green (84 files / 1420 tests).Docs
Parameter table row plus a section explaining the failure mode, in both EN and DE (
user-guide/actions/download.mdx).astro buildpasses — 90 pages, 2 languages.