Mateo Wang 963333d654 fix(proxy)!: let proxy admin keys read raw cloud storage file ids on GET /files/{id}/content (#40621) ... * fix(proxy): let proxy admin keys read raw cloud storage file ids on GET /files/{id}/content Since #30595 the endpoint answered 400 for every raw gs:// or s3:// id, which broke the documented unmanaged Vertex batch flow at its last step, while a double-encoded id slipped past the guard entirely. Raw ids are now readable by proxy admin keys only, every other key gets 403, and the guard decodes the id fully before deciding, so encoding depth no longer matters * fix(proxy): decode nested percent-encoded file ids iteratively An id percent-encoded a thousand or more times sent the recursive decoder past the interpreter's recursion limit, so a proxy admin key got a 500 instead of a verdict on the id. The decoder now walks the encodings in a loop, so any depth resolves * fix(proxy): cap the decode passes the raw cloud storage file id guard makes Any authenticated key could send a file id wrapped in tens of thousands of percent-encoding layers and the guard would unwrap every one of them, each pass walking the whole id, so a 120 KB request line held a worker for about five seconds and a 2 MB one for minutes. The guard now unwraps at most eight layers, and an id still changing after that is treated as a raw cloud storage id, so it stays admin-only instead of being decoded any further * refactor(proxy): type the decode step the raw cloud storage file id guard folds over * test(proxy): return a streaming result from the admin raw id test mock now that vertex_ai file content streams * test(proxy): send raw cloud ids to the content route the way uvicorn delivers them Starlette's TestClient decodes the path twice, so the twice-encoded cases reached the route fully decoded and never hit the decode loop. The cases now name the id the route receives, and the helper tests take a typed quote helper and Final constants. * test(proxy): mark the raw cloud id test locals Final		2026-10-20 10:58:42 +00:00
..
__init__.py	test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006)	2026-10-01 11:06:42 -07:00
test_batch_guardrails.py	refactor(proxy): expose public names for private proxy helpers (#45170)	2026-10-07 18:59:27 -07:00
test_file_usage_caps.py	feat(proxy): cap batch file records, daily batch uploads, and per-file downloads (#43632)	2026-10-06 03:06:36 +00:00
test_files_batch_file_validation.py	fix(vertex_ai): return 400 with file line number for malformed batch JSONL row (#40097)	2026-10-15 03:21:48 -07:00
test_files_common_utils.py	fix(rag)!: use team provider credentials and allow viewer and JWT team access (#45497)	2026-10-17 23:51:48 +00:00
test_files_endpoint.py	fix(proxy)!: let proxy admin keys read raw cloud storage file ids on GET /files/{id}/content (#40621)	2026-10-20 10:58:42 +00:00
test_general_upload_validation.py	test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006)	2026-10-01 11:06:42 -07:00
test_storage_backend_service.py	test(proxy): move utils, agent_endpoints and endpoint tests into tests/unit/proxy (#44006)	2026-10-01 11:06:42 -07:00