47 lines
4.0 KiB
Markdown
47 lines
4.0 KiB
Markdown
## 1. Platform Artifact Download Contracts
|
|
|
|
- [x] 1.1 Add domain and DTO contracts for browser artifact metadata, download references, range/content requests, progress, and safe errors.
|
|
- [x] 1.2 Add validators for artifact IDs, owner/user/plugin scope, availability state, range bounds, response size, checksum metadata, and unsafe secret/path/socket content.
|
|
- [x] 1.3 Add service methods for authorized artifact metadata lookup, download reference creation, and bounded content reads.
|
|
|
|
## 2. Platform Artifact Download API
|
|
|
|
- [x] 2.1 Implement artifact metadata/download reference route using named DTOs and service methods.
|
|
- [x] 2.2 Implement bounded artifact content/range route with safe headers and integrity metadata.
|
|
- [x] 2.3 Integrate plugin bridge artifact actions with safe artifact references.
|
|
- [x] 2.4 Update platform route/protocol documentation for browser artifact download and deferred storage backend behavior.
|
|
- [x] 2.5 Add platform tests for successful download, range reads, unavailable artifacts, unauthorized scope, unsafe references, and no raw path/credential responses.
|
|
|
|
## 3. Frontend Browser Transfer
|
|
|
|
- [x] 3.1 Add centralized `platform_web/api` artifact download types and client methods.
|
|
- [x] 3.2 Add UI controls/state for artifact download/open flows from relevant server/job/plugin contexts.
|
|
- [x] 3.3 Add bridge host handling for artifact references and browser-mediated download actions.
|
|
- [x] 3.4 Add frontend tests for progress/success/error states, unauthorized failures, and no raw secret/path rendering.
|
|
|
|
## 4. Plugin SDK Artifact Helpers
|
|
|
|
- [x] 4.1 Add or update plugin SDK helpers for artifact bridge request/reference parsing if bridge artifact actions need new helper types.
|
|
- [x] 4.2 Add plugin tests for artifact reference helpers and forbidden direct run/storage access assumptions if helper code changes.
|
|
|
|
## 5. Verification
|
|
|
|
- [x] 5.1 Run `cd platform && go test ./...` and record evidence.
|
|
- [x] 5.2 Run `cd platform_web && npm run typecheck && npm test && npm run build` and record evidence.
|
|
- [x] 5.3 Run relevant plugin tests/typecheck if plugin SDK helpers changed and record evidence.
|
|
- [x] 5.4 Run browser walkthrough for artifact download/browser transfer and record evidence.
|
|
- [x] 5.5 Run `scripts/check-structure.sh` and record evidence.
|
|
- [x] 5.6 Run `openspec validate implement-artifact-download-and-browser-transfer --strict` and record evidence.
|
|
|
|
## Evidence
|
|
|
|
- 1.1-2.5: `cd platform && go test ./api -run TestArtifactDownload` passed, covering browser-safe references, bounded content/range reads, unavailable artifact rejection, unauthorized scope denial, bridge `artifacts.open`, and forbidden fragment checks.
|
|
- 3.1-3.4: `cd platform_web && npm run typecheck` passed. `cd platform_web && npm test -- --run api/client.test.ts utils/pluginBridgeHost.test.ts pages/ServerDetailPage.test.tsx` passed, covering artifact client methods, chunk metadata, bridge artifact reference parsing/rejection, and server detail artifact workflow source checks.
|
|
- 4.1-4.2: `cd plugins && npm run typecheck` passed. `cd plugins && npm test` passed, covering `createArtifactOpenRequest`, `parseArtifactReference`, permission checks, and rejection of direct storage URL assumptions.
|
|
- 5.1: `cd platform && go test ./...` passed.
|
|
- 5.2: `cd platform_web && npm run typecheck` passed; `cd platform_web && npm test` passed; `cd platform_web && npm run build` passed.
|
|
- 5.3: `cd plugins && npm run typecheck` passed; `cd plugins && npm test` passed.
|
|
- 5.4: Browser walkthrough passed with a temporary local mock server and headless Chrome: opened server detail, selected `操作历史`, clicked artifact `打开`, observed `已打开 artifact-walk.bin`, and checked rendered text for forbidden path/token/storage fragments. Temporary walkthrough files were removed.
|
|
- 5.5: `scripts/check-structure.sh` passed.
|
|
- 5.6: `openspec validate implement-artifact-download-and-browser-transfer --strict` reported `Change 'implement-artifact-download-and-browser-transfer' is valid`. PostHog telemetry flush logged DNS errors afterward, but validation exited 0.
|