Skip to content

fix(http): replace temp paths with upload ids#1012

Open
qin-ctx wants to merge 2 commits intomainfrom
fix/http-temp-file-id
Open

fix(http): replace temp paths with upload ids#1012
qin-ctx wants to merge 2 commits intomainfrom
fix/http-temp-file-id

Conversation

@qin-ctx
Copy link
Collaborator

@qin-ctx qin-ctx commented Mar 26, 2026

Description

Replace HTTP temp upload path exposure with opaque temp_file_id values and update clients, tests, and docs to use the new upload flow.

Related Issue

Fixes #1013

Type of Change

  • Bug fix (non-breaking change that fixes an issue)
  • New feature (non-breaking change that adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Refactoring (no functional changes)
  • Performance improvement
  • Test update

Changes Made

  • replace HTTP temp_path usage with temp_file_id so temp uploads no longer expose host filesystem paths
  • tighten server-side validation for uploaded temp files and reject legacy direct-path patterns in resources, skills, and pack import APIs
  • update Python/Rust clients, console flow, tests, and bilingual docs, including raw HTTP guidance for zipped directory uploads

Testing

  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes
  • I have tested this on the following platforms:
    • Linux
    • macOS
    • Windows

Checklist

  • My code follows the project's coding style
  • I have performed a self-review of my code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • My changes generate no new warnings
  • Any dependent changes have been merged and published

Screenshots (if applicable)

Additional Notes

  • Local verification:
    • .venv/bin/python -m pytest tests/server/test_api_resources.py tests/server/test_api_local_input_security.py tests/server/test_api_relations.py tests/client/test_http_client_local_upload.py -q
    • .venv/bin/python -m pytest tests/server/test_http_client_sdk.py tests/server/test_error_scenarios.py -q
    • cargo check -p ov_cli

Stop exposing server filesystem paths through temp uploads and require
HTTP callers to use temp_file_id across server, clients, tests, and docs.
@github-actions
Copy link

Failed to generate code suggestions for PR

Make the Rust HTTP client import local ovpack files through temp uploads
and cover the flow with an end-to-end SDK regression test.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Backlog

Development

Successfully merging this pull request may close these issues.

Harden HTTP temp upload IDs and raw directory upload docs

1 participant