From cbb6593441c4dcd86f9f7a5a95f7c4ef374ac07c Mon Sep 17 00:00:00 2001 From: Dotta Date: Tue, 27 Oct 2026 02:36:26 -0500 Subject: [PATCH] Download registered artifacts through authenticated attachment transport --- tests/runner-e2e/registered-artifact.test.ts | 40 +++++++++++++++----- tests/runner-e2e/registered-artifact.ts | 4 +- 2 files changed, 32 insertions(+), 12 deletions(-) diff --git a/tests/runner-e2e/registered-artifact.test.ts b/tests/runner-e2e/registered-artifact.test.ts index 4499902c8e7..3e00b476a8b 100644 --- a/tests/runner-e2e/registered-artifact.test.ts +++ b/tests/runner-e2e/registered-artifact.test.ts @@ -1,23 +1,23 @@ import { createHash } from "node:crypto"; import { expect, it, vi } from "vitest"; -import { pollUntil, type RunnerApi } from "./api.js"; +import { pollUntil, RunnerApi } from "./api.js"; import { readRegisteredArtifacts, RegisteredArtifactNotFoundError } from "./registered-artifact.js"; import { evaluateMatcher } from "./matchers.js"; function fixture() { const bytes = Buffer.from("verified\n"); - const product = { id: "product", issueId: "issue", createdByRunId: "run", type: "artifact", status: "active", title: "proof.txt", metadata: { attachmentId: "attachment" } }; - const attachment = { id: "attachment", issueId: "issue", originatingRunId: "run", originalFilename: "proof.txt", contentType: "text/plain", byteSize: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") }; - const download = vi.fn().mockResolvedValue({ ok: () => true, body: async () => bytes }); + const product = { id: "product", issueId: "issue", createdByRunId: "run", type: "artifact", status: "active", title: "proof.txt", metadata: { attachmentId: "4d6f7d24-bc94-42e5-9c47-26d18f212d8e" } }; + const attachment = { id: "4d6f7d24-bc94-42e5-9c47-26d18f212d8e", issueId: "issue", originatingRunId: "run", originalFilename: "proof.txt", contentType: "text/plain", byteSize: bytes.length, sha256: createHash("sha256").update(bytes).digest("hex") }; + const download = vi.fn().mockResolvedValue(bytes); const get = vi.fn().mockImplementation(async (path: string) => path.endsWith("work-products") ? [product] : [attachment]); - return { product, attachment, download, get, api: { get, request: { get: download } } as unknown as RunnerApi }; + return { product, attachment, download, get, api: { get, getAttachmentContent: download, request: { get: () => { throw new Error("Unauthenticated transport forbidden"); } } } as unknown as RunnerApi }; } it.each(["active", "ready_for_review", "approved"])("downloads the exact registered run-attributed %s output through its public path", async status => { const { api, product, download } = fixture(); product.status = status; const artifacts = await readRegisteredArtifacts(api, "issue", "run", ["proof.txt"]); - expect(download).toHaveBeenCalledWith("/api/attachments/attachment/content?download=1"); + expect(download).toHaveBeenCalledWith("4d6f7d24-bc94-42e5-9c47-26d18f212d8e"); expect((await evaluateMatcher({ kind: "artifact_exact", name: "proof.txt", expected: "verified\n", mimeType: "text/plain" }, { artifacts })).passed).toBe(true); }); @@ -45,7 +45,7 @@ it.each(["unregistered", "duplicate", "old-run", "unattributed", "wrong-issue", if (reason === "excessive-size") attachment.byteSize = 262_145; if (reason === "size-mismatch") attachment.byteSize += 1; if (reason === "hash-mismatch") attachment.sha256 = "incorrect"; - if (reason === "download-failure") download.mockResolvedValue({ ok: () => false, status: () => 404 }); + if (reason === "download-failure") download.mockRejectedValue(new Error("Authenticated download returned 404")); await expect(readRegisteredArtifacts(api, "issue", "run", ["proof.txt"])).rejects.toThrow(); }); @@ -65,7 +65,7 @@ it("distinguishes a checkpoint not yet registered from corrupt or unauthorized e get.mockImplementation(async (path: string) => path.endsWith("work-products") ? [product, { ...product, id: "duplicate" }] : [attachment]); await expect(readRegisteredArtifacts(api, "issue", "run", ["proof.txt"])).rejects.not.toBeInstanceOf(RegisteredArtifactNotFoundError); get.mockImplementation(async (path: string) => path.endsWith("work-products") ? [product] : [attachment]); - download.mockResolvedValue({ ok: () => false, status: () => 403 }); + download.mockRejectedValue(new Error("Authenticated download returned 403")); await expect(readRegisteredArtifacts(api, "issue", "run", ["proof.txt"])).rejects.not.toBeInstanceOf(RegisteredArtifactNotFoundError); get.mockRejectedValue(new Error("read access revoked")); await expect(readRegisteredArtifacts(api, "issue", "run", ["proof.txt"])).rejects.toThrow("read access revoked"); @@ -81,7 +81,7 @@ it.each(["duplicate", "corrupt", "revoked"])("strict checkpoint polling retains if (reads === 1 && reason === "revoked") throw new Error("read access revoked"); return reads === 1 && reason === "duplicate" ? [product, { ...product, id: "duplicate" }] : [product]; }); - if (reason === "corrupt") download.mockResolvedValueOnce({ ok: () => true, body: async () => Buffer.from("bad bytes") }); + if (reason === "corrupt") download.mockResolvedValueOnce(Buffer.from("bad bytes")); await expect(pollUntil({ label: "strict checkpoint", deadlineAt: Date.now() + 1000, intervalMs: 1, retryOnError: () => false, load: () => readRegisteredArtifacts(api, "issue", "run", ["proof.txt"]).catch(error => { @@ -90,3 +90,25 @@ it.each(["duplicate", "corrupt", "revoked"])("strict checkpoint polling retains }), accept: rows => rows.length === 1 })).rejects.toThrow(); expect(reads).toBe(1); }); + +it("uses the actual human-session authenticated transport for metadata and exact attachment bytes", async () => { + const { product, attachment } = fixture(), bytes = Buffer.from("verified\n"); + vi.stubEnv("PAPERCLIP_RUNNER_E2E_PORT", "31991"); + const raw = vi.fn(() => { throw new Error("Raw request loses human session"); }); + const fetcher = vi.fn(async (url: URL | string, options: RequestInit) => { + expect(options.headers).toMatchObject({ Cookie: "synthetic-owner-session", Origin: "http://127.0.0.1:31991" }); + const endpoint = new URL(url).pathname; + if (endpoint.endsWith("work-products")) return Response.json([product]); + if (endpoint.endsWith("attachments")) return Response.json([attachment]); + expect(endpoint).toBe(`/api/attachments/${attachment.id}/content`); + return new Response(bytes); + }); + vi.stubGlobal("fetch", fetcher); + try { + const api = new RunnerApi({ get: raw } as unknown as ConstructorParameters[0]); + api.setBrowserSession("synthetic-owner-session"); + const [artifact] = await readRegisteredArtifacts(api, "issue", "run", ["proof.txt"]); + expect(artifact).toMatchObject({ contentVerified: true, sha256: attachment.sha256, content: "verified\n" }); + expect(raw).not.toHaveBeenCalled(); expect(fetcher).toHaveBeenCalledTimes(3); + } finally { vi.unstubAllGlobals(); vi.unstubAllEnvs(); } +}); diff --git a/tests/runner-e2e/registered-artifact.ts b/tests/runner-e2e/registered-artifact.ts index 9531119fe36..535d6e414d9 100644 --- a/tests/runner-e2e/registered-artifact.ts +++ b/tests/runner-e2e/registered-artifact.ts @@ -35,9 +35,7 @@ export async function readRegisteredArtifacts(api: RunnerApi, issueId: string, r if (!Number.isSafeInteger(attachment.byteSize) || attachment.byteSize < 0 || attachment.byteSize > 262_144) { throw new Error(`Registered artifact ${name} has an invalid or excessive size`); } - const response = await api.request.get(`/api/attachments/${encodeURIComponent(attachment.id)}/content?download=1`); - if (!response.ok()) throw new Error(`Registered artifact ${name} download returned ${response.status()}`); - const bytes = await response.body(); + const bytes = await api.getAttachmentContent(attachment.id); const sha256 = createHash("sha256").update(bytes).digest("hex"); if (bytes.length !== attachment.byteSize || sha256 !== attachment.sha256) { throw new Error(`Downloaded registered artifact ${name} disagrees with stored bytes`);