Fix file tokens not working on file-security #10120
Conversation
📝 Walkthrough""" WalkthroughThe changes introduce PHPDoc-style type annotations for variables representing storage buckets and files in the storage API controller, clarifying their expected types. Conditional checks for file access are updated to include an additional token-based access condition. In a shared API controller, an unused variable assignment is removed, simplifying the code without affecting functionality. Additionally, a single blank line is added for readability in a file action handler after an exception check. A new end-to-end test method is added to verify downloading files with file-level security using tokens. No function signatures or public entity declarations are altered. Possibly related issues
Possibly related PRs
Suggested reviewers
📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
Security Scan Results for PRDocker Image Scan Results
Source Code Scan Results🎉 No vulnerabilities found! |
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
app/controllers/api/storage.php (2)
970-971: Use the standard@varPHPDoc tag instead of the non-standard@typeStatic analysers (Psalm, PHPStan) and IDEs recognise the
/** @var … */annotation;/* @type … */is ignored, so you lose the type-hinting benefit you are aiming for.- /* @type Document $bucket */ + /** @var Document $bucket */ - /* @type Document $file */ + /** @var Document $file */Apply the same replacement to every
@typeoccurrence added in this PR (preview, download, view actions).Also applies to: 1162-1164, 1183-1185, 1323-1325, 1345-1346
980-988: Token bypass condition looks correct – just confirm coverageThe new
$isTokenflag is now part of all auth shortcuts:if (!$fileSecurity && !$valid && !$isToken) { … }and
if ($fileSecurity && !$valid && !$isToken) { … }That should let a valid resource token access a private bucket / file while still blocking everyone else – nice.
Please ensure there are integration tests for:
- valid token + no read permission → allowed
- invalid token + no read permission →
USER_UNAUTHORIZEDHappy to scaffold Behat/Pest tests if needed.
Also applies to: 1172-1180, 1333-1341
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (3)
app/controllers/api/storage.php(6 hunks)app/controllers/shared/api.php(0 hunks)src/Appwrite/Platform/Modules/Tokens/Http/Tokens/Buckets/Files/Action.php(1 hunks)
💤 Files with no reviewable changes (1)
- app/controllers/shared/api.php
🧰 Additional context used
🧬 Code Graph Analysis (1)
app/controllers/api/storage.php (1)
src/Appwrite/Event/Database.php (1)
getDocument(107-110)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Setup & Build Appwrite Image
- GitHub Check: Setup & Build Appwrite Image
- GitHub Check: scan
🔇 Additional comments (1)
src/Appwrite/Platform/Modules/Tokens/Http/Tokens/Buckets/Files/Action.php (1)
37-42: No-op change – nothing to reviewOnly an extra blank line was introduced after the
STORAGE_FILE_NOT_FOUNDguard.
Behaviour, readability and PSR-12 compliance remain intact.
✨ Benchmark results
⚡ Benchmark Comparison
|
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
tests/e2e/Services/Tokens/TokensBase.php(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (3)
- GitHub Check: Benchmark
- GitHub Check: Setup & Build Appwrite Image
- GitHub Check: scan
🔇 Additional comments (1)
tests/e2e/Services/Tokens/TokensBase.php (1)
278-278: LGTM: Blank line improves readability.The blank line addition helps separate the test methods for better readability.
What does this PR do?
Fixes an issue with file tokens not working when file security was enabled on bucket.
Test Plan
Manual.
Screen.Recording.2025-07-08.at.2.31.54.PM.mov
Related PRs and Issues
Checklist