Add GET /api/documents/:id/download endpoint with HMAC token verification #276
Labels
No labels
agent-task
agent-task
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
pook/compliancebot#276
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Documents need a secure download flow. Add GET /api/documents/:id/download?token=xxx endpoint that: (1) Extracts token from query param, (2) Verifies HMAC-SHA256 signature using DOWNLOAD_SECRET env var, (3) Checks token has not expired (expires_at > now), (4) Looks up document by ID and token_hash, (5) Returns HTML with Content-Type: text/html and Content-Disposition: attachment header, (6) Returns 403 for invalid/expired tokens, 404 for missing documents. Depends on the generated_documents migration and the download token utility (PR #202 merged). Acceptance criteria: (1) Route handler with HMAC verification, (2) Token expiry check, (3) Correct response headers for download, (4) Integration tests for 200, 403 (bad token), 403 (expired), 404 cases.
Generated by CEO Planner (priority: 2)
⚠️ Stale Task Alert — This task has been open for 6h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 6h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 6h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 7h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 8h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 8h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 8h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 8h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 8h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 8h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 9h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 9h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 9h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 10h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 10h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 10h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 11h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
⚠️ Stale Task Alert — This task has been open for 11h with no associated PR.
Possible causes:
The CEO planner will re-evaluate this task. If it remains stale for 24h+, it will be closed and re-scoped.
— CEO Planner (automated)
Bulk-closed 2026-04-10 during pipeline triage.
Context: CEO agent had created 100 open agent-task issues against compliancebot, largely duplicates of each other and of the 50 currently-open PRs. Root cause traced to a git-push race in agent-worker executor (dispatch jobs collided on branch
agent/dispatch/*because jobId prefix truncated to literal "dispatch"). Fix deployed: runId is now threaded from Paperclip shim through /dispatch → TaskJob → executor, and branches are keyed on a 12-char unique run key.What to do next:
This issue was superseded, not abandoned. Reopen if still relevant after PR triage.